LUT-Compiled Kolmogorov-Arnold Networks for Lightweight DoS Detection on IoT Edge Devices

TL;DR

The paper addresses DoS detection for resource-limited IoT edge devices by replacing costly runtime B-spline evaluations in Kolmogorov-Arnold Networks (KANs) with a lookup-table (LUT) compilation pipeline. This LUT-KAN preserves the high accuracy of a two-layer KAN while dramatically reducing inference latency on CPU-only hardware, achieving up to $>5000\times$ speedups with only about a $2\times$ memory increase on CICIDS2017 DoS data. It provides a thorough evaluation across LUT resolutions $L$, quantization schemes, and out-of-bounds policies, establishing clear Pareto frontiers between accuracy, latency, and memory. The approach enables deterministic, real-time DoS detection on edge gateways with a minimal resource footprint, and the authors provide public code and data to facilitate adoption and further research.

Abstract

Denial-of-Service (DoS) attacks pose a critical threat to Internet of Things (IoT) ecosystems, yet deploying effective intrusion detection on resource-constrained edge devices remains challenging. Kolmogorov-Arnold Networks (KANs) offer a compact alternative to Multi-Layer Perceptrons (MLPs) by placing learnable univariate spline functions on edges rather than fixed activations on nodes, achieving competitive accuracy with fewer parameters. However, runtime B-spline evaluation introduces significant computational overhead unsuitable for latency-critical IoT applications. We propose a lookup table (LUT) compilation pipeline that replaces expensive spline computations with precomputed quantized tables and linear interpolation, dramatically reducing inference latency while preserving detection quality. Our lightweight KAN model (50K parameters, 0.19~MB) achieves 99.0\% accuracy on the CICIDS2017 DoS dataset. After LUT compilation with resolution $L=8$, the model maintains 98.96\% accuracy (F1 degradation $<0.0004$) while achieving $\mathbf{68\times}$ speedup at batch size 256 and over $\mathbf{5000\times}$ speedup at batch size 1, with only $2\times$ memory overhead. We provide comprehensive evaluation across LUT resolutions, quantization schemes, and out-of-bounds policies, establishing clear Pareto frontiers for accuracy-latency-memory trade-offs. Our results demonstrate that LUT-compiled KANs enable real-time DoS detection on CPU-only IoT gateways with deterministic inference latency and minimal resource footprint.

Figures (10)

• Figure 1: LUT-KAN architecture for DoS detection. The network processes 78 flow-level features through two KAN layers with 32 and 16 neurons respectively. Each learnable $\phi$ function is compiled from B-splines to precomputed lookup tables for efficient edge inference.
• Figure 2: Feature correlation heatmap for top 15 features. Strong correlations exist within packet length statistics (upper-left cluster) and inter-arrival time features (center cluster).
• Figure 3: Training dynamics over 200 epochs. Left: Loss convergence showing stable optimization without overfitting. Right: Accuracy progression demonstrating rapid initial learning followed by gradual refinement.
• Figure 4: Baseline model evaluation curves. Left: ROC curve with AUC=0.999. Right: Precision-Recall curve with AP=0.999 demonstrating robust performance.
• Figure 5: Model threshold analysis. (a) Performance metrics remain stable across decision thresholds. (b) Precision-recall trade-off curve.