Abstract

The significant growth of IoT devices has created serious concerns related to the security of these devices, as they are resource-constrained and have weak security, which allows attackers to use them as botnets, evading traditional defences designed for resource-rich systems. Constrained by weak hardware and encrypted data, IoT devices need a better solution. This work uses network flow signatures—a lightweight method that detects threats by analysing communication patterns alone, without accessing device internals. The major focus is on packet metadata (e.g., packet size, packet volume, source and destination IP address) rather than the contents of the packet. By fusing statistical anomaly detection with deep learning architectures, the system learns normal device behaviour and flags threats instantly, running efficiently even on limited hardware. The model learns normal behaviour and known threats, then detects attacks instantly with low resource usage. Machine learning is invoked only when there is sufficient evidence that a device is being compromised, in order to minimise computational overhead. Results demonstrate that the system is easily scalable, detects attacks early, produces fewer false alarms through timing analysis, and is straightforward to deploy across all IoT devices. Capturing a per-device baseline flow makes this approach unique, while risk-based sampling further improves resource efficiency.