Lightweight Autoencoder-Isolation Forest Anomaly Detection for Green IoT Edge Gateways

TL;DR

EcoDefender addresses the challenge of reliable anomaly detection in resource-constrained IoT edge gateways by marrying Autoencoder-based representation learning with Isolation Forest scoring. The framework emphasizes not only detection performance but also system-level efficiency and environmental impact, providing formal guarantees for convergence, stability, and energy–complexity coupling. Empirical results on Bot-IoT-based edge testbeds show strong detection (ROC-AUC up to 0.963 and F1 up to 0.92) while maintaining low latency (~27 ms) and modest CPU/memory footprints, and revealing a near-linear relationship between energy use and carbon emissions. This work demonstrates that high-security performance can be achieved alongside sustainability goals, informing practical deployments aligned with SDG 9 and SDG 13 for green IoT infrastructures.

Abstract

The rapid growth of the Internet of Things (IoT) has given rise to highly diverse and interconnected ecosystems that are increasingly susceptible to sophisticated cyber threats. Conventional anomaly detection schemes often prioritize accuracy while overlooking computational efficiency and environmental impact, which limits their deployment in resource-constrained edge environments. This paper presents \textit{EcoDefender}, a sustainable hybrid anomaly detection framework that integrates \textit{Autoencoder(AE)}-based representation learning with \textit{Isolation Forest(IF)} anomaly scoring. Beyond empirical performance, EcoDefender is supported by a theoretical foundation that establishes formal guarantees for its stability, convergence, robustness, and energy-complexity coupling-thereby linking computational behavior to energy efficiency. Furthermore, experiments on realistic IoT traffic confirm these theoretical insights, achieving up to 94\% detection accuracy with an average CPU usage of only 22\%, 27 ms inference latency, and 30\% lower energy consumption compared to AE-only baselines. By embedding sustainability metrics directly into the security evaluation process, this work demonstrates that reliable anomaly detection and environmental responsibility can coexist within next-generation green IoT infrastructures, aligning with the United Nations Sustainable Development Goals (SDG 9: resilient infrastructure, SDG 13: climate action).

Figures (14)

• Figure 1: EcoDefender framework for real-time IoT anomaly detection using AE--IF with dynamic thresholded tuning.
• Figure 2: Experimental IoT edge testbed.
• Figure 3: Comparison of EcoDefender performance between the training phase and edge gateways.
• Figure 4: ROC curve of EcoDefender across different traffic types.
• Figure 5: Distribution of anomaly scores for benign and attack traffic.