CCA-ID: Confidence-calibrated adaptive intrusion detection with selective routing for IoT networks

Abstract

The rapid expansion of Internet of Things (IoT) deployments has extended the cyber-attack surface. In resource-constrained IoT monitoring environments, maintaining always-on deep or ensemble-based intrusion detection can be challenging for high-rate, real-time traffic. This study presents CCA-ID, Confidence Calibrated Adaptive Intrusion Detection which integrates calibrated decision confidence with selective, resource-aware inference for IoT intrusion detection. CCA-ID combines an isotonic-calibrated logistic regression gate, heterogeneous heavy learners including DNN, XGBoost, and LightGBM, and a stacking meta-classifier within a class-specific confidence-driven routing mechanism. High-confidence samples are finalized by the lightweight calibrated gate, whereas low-confidence samples are selectively routed to the heavy ensemble for deeper analysis. The proposed CCA-ID is evaluated on the large-scale Gotham Dataset 2025, using a final experimental dataset comprising 7,792,438 packet-level samples across 18 traffic classes. Experimental results indicate that CCA-ID achieves 89.92% accuracy, 61.70% macro F1-score, and 98.93% macro ROC-AUC, while routing only 6.28% of samples to the heavy ensemble. The method also achieves an Expected Calibration Error (ECE) of 7.66%, showing improved confidence reliability for routing decisions. An inference-time analysis further indicates that CCA-ID achieves a 13.94 × speedup over the always-on heavy stack on a fixed stratified subset of the held-out test set. Overall, CCA-ID provides a calibrated trade-off between selective inference and heavy-model invocation for IoT intrusion detection. It reduces unnecessary heavy-model usage while maintaining strong threshold-free discriminative performance under severe class imbalance.

The authors' abstract, as published at the source. Expert Systems with Applications, 2026 · DOI ↗