An Interpretable and Lightweight Intrusion Detection Framework for IoT Networks Using Autoencoder-Based Feature Learning

An Interpretable and Lightweight Intrusion Detection Framework for IoT Networks Using Autoencoder-Based Feature Learning | Authorea try { document.documentElement.classList.add('js'); } catch (e) { } var _gaq = _gaq || []; _gaq.push(['_setAccount', 'G-8VDV14Y67G']); _gaq.push(['_trackPageview']); (function() { var ga = document.createElement('script'); ga.type = 'text/javascript'; ga.async = true; ga.src = ('https:' == document.location.protocol ? 'https://ssl' : 'http://www') + '.google-analytics.com/ga.js'; var s = document.getElementsByTagName('script')[0]; s.parentNode.insertBefore(ga, s); })(); Skip to main content Preprints Collections Wiley Open Research IET Open Research Ecological Society of Japan All Collections About About Authorea FAQs Contact Us Quick Search anywhere Search for preprint articles, keywords, etc. Search Search ADVANCED SEARCH SCROLL This is a preprint and has not been peer reviewed. Data may be preliminary. 3 February 2026 V1 Latest version Share on An Interpretable and Lightweight Intrusion Detection Framework for IoT Networks Using Autoencoder-Based Feature Learning Authors : Sudha Singh 0009-0008-0836-944X [email protected] , Uday Deo , Vijaypal Singh Rathor , Neelam Dayal , Anurag Singh 0000-0001-5354-4691 , Pritee Khanna , and Aparajita Ojha Authors Info & Affiliations https://doi.org/10.22541/au.177011669.94319480/v1 133 views 58 downloads Contents Abstract Supplementary Material Information & Authors Metrics & Citations View Options References Figures Tables Media Share Abstract The use of Internet of Things (IoT) devices has grown rapidly in recent years. This has increased the need for intrusion detection systems that are accurate, efficient, and easy to understand. Traditional signature-based detection methods are not well suited for modern IoT networks, as attack patterns change quickly. At the same time, many deep learning approaches require high computation and are difficult to interpret, which limits their use on resource-constrained devices.This work presents an intrusion detection framework that combines autoencoder-based feature learning with classical machine learning classifiers. An unsupervised autoencoder is used to learn compact nonlinear representations of network traffic. This reduces the number of features while keeping information that is important for detecting attacks. Interpretability is handled using an encoder weight aggregation method, which helps explain how input features affect the learned representation. To deal with class imbalance, Borderline-SMOTE is applied before splitting the data. In addition to experiments, theoretical analysis is used to study generalization, feature efficiency, and computational cost.The framework is evaluated on the BoT-IoT and UNSW-NB15 datasets. Among all tested models, the Autoencoder–Random Forest combination performs the best. Using only 16 latent features, the model achieves an F1-score of 0.999 and an accuracy of 99.95% on the BoT-IoT dataset. On the more challenging UNSW-NB15 dataset, it reaches an F1-score of 0.809 with an accuracy of 80.95%. These results show that effective and interpretable intrusion detection is possible without using deep or computationally heavy models, making the proposed approach suitable for IoT and edge computing environments. Supplementary Material File (sudha_paper.pdf) Download 562.47 KB Information & Authors Information Version history V1 Version 1 03 February 2026 Copyright This work is licensed under a Non Exclusive No Reuse License. Keywords autoencoder feature reduction internet of things intrusion detection system random forest Authors Affiliations Sudha Singh 0009-0008-0836-944X [email protected] PDPM Indian Institute of Information Technology Design and Manufacturing Jabalpur View all articles by this author Uday Deo National Institute of Technology Delhi View all articles by this author Vijaypal Singh Rathor Atal Bihari Vajpayee Indian Institute of Information Technology and Management View all articles by this author Neelam Dayal PDPM Indian Institute of Information Technology Design and Manufacturing Jabalpur View all articles by this author Anurag Singh 0000-0001-5354-4691 National Institute of Technology Delhi View all articles by this author Pritee Khanna PDPM Indian Institute of Information Technology Design and Manufacturing Jabalpur View all articles by this author Aparajita Ojha PDPM Indian Institute of Information Technology Design and Manufacturing Jabalpur View all articles by this author Metrics & Citations Metrics Article Usage 133 views 58 downloads .FvxKWukQNSOunydq8rnd { width: 100px; } Citations Download citation Sudha Singh, Uday Deo, Vijaypal Singh Rathor, et al. An Interpretable and Lightweight Intrusion Detection Framework for IoT Networks Using Autoencoder-Based Feature Learning. Authorea . 03 February 2026. DOI: https://doi.org/10.22541/au.177011669.94319480/v1 If you have the appropriate software installed, you can download article citation data to the citation manager of your choice. Simply select your manager software from the list below and click Download. For more information or tips please see 'Downloading to a citation manager' in the Help menu . Format Please select one from the list RIS (ProCite, Reference Manager) EndNote BibTex Medlars RefWorks Direct import Tips for downloading citations document.getElementById('citMgrHelpLink').addEventListener('click', function() { popupHelp(this.href); return false; }); $(".js__slcInclude").on("change", function(e){ if ($(this).val() == 'refworks') $('#direct').prop("checked", false); $('#direct').prop("disabled", ($(this).val() == 'refworks')); }); View Options View options PDF View PDF Figures Tables Media Share Share Share article link Copy Link Copied! Copying failed. Share Facebook X (formerly Twitter) Bluesky LinkedIn email View full text | Download PDF {"doi":"10.22541/au.177011669.94319480/v1","type":"Article"} Now Reading: Share Figures Tables Close figure viewer Back to article Figure title goes here Change zoom level Go to figure location within the article Download figure Toggle share panel Toggle share panel Share Toggle information panel Toggle information panel Go to previous graphic Go to next graphic Go to previous table Go to next table All figures All tables View all material View all material xrefBack.goTo xrefBack.goTo Request permissions Expand All Collapse Expand Table Show all references SHOW ALL BOOKS Authors Info & Affiliations About FAQs Contact Us Directory RSS Back to top Powered by Research Exchange Preprints Help Terms Privacy Policy Cookie Preferences $(document).ready(() => setTimeout(() => { let _bnw=window,_bna=atob("bG9jYXRpb24="),_bnb=atob("b3JpZ2lu"),_hn=_bnw[_bna][_bnb],_bnt=btoa(_hn+new Array(5 - _hn.length % 4).join(" ")); $.get("/resource/lodash?t="+_bnt); },4000)); (function(){function c(){var b=a.contentDocument||a.contentWindow.document;if(b){var d=b.createElement('script');d.innerHTML="window.__CF$cv$params={r:'9fe02ace688c58f4',t:'MTc3OTE2MjkzOA=='};var a=document.createElement('script');a.src='/cdn-cgi/challenge-platform/scripts/jsd/main.js';document.getElementsByTagName('head')[0].appendChild(a);";b.getElementsByTagName('head')[0].appendChild(d)}}if(document.body){var a=document.createElement('iframe');a.height=1;a.width=1;a.style.position='absolute';a.style.top=0;a.style.left=0;a.style.border='none';a.style.visibility='hidden';document.body.appendChild(a);if('loading'!==document.readyState)c();else if(window.addEventListener)document.addEventListener('DOMContentLoaded',c);else{var e=document.onreadystatechange||function(){};document.onreadystatechange=function(b){e(b);'loading'!==document.readyState&&(document.onreadystatechange=e,c())}}}})();