Lightweight Heterogeneous Graph-Inspired Neural Networks for Real-Time Botnet Detection

Abstract

Rapid Internet of Things (IoT) expansion creates security risks due to resource limits and evolving botnets. While Graph Neural Networks (GNNs) offer accuracy, their computational demands hinder real-time edge deployment. This study presents IoTGuard, based on a ‘Hetero-MLP’ architecture. The model replaces costly message passing with 8-dimensional categorical embeddings to capture protocol semantics. To avoid topology overfitting, L3 identifiers were excluded, relying on 13 L4 attributes selected via Pearson correlation. Evaluations on the NF-BoT-IoT-v2 dataset (37.7 M samples) demonstrate a 12.17 KB (INT8) footprint via post-training quantization. This represents a 1.9× size reduction, enabling independent operation on ARM Cortex-M7 platforms (Arm Ltd., Cambridge, UK) at 37,093 requests per second. The framework achieves a DDoS F1-score of 0.9943 with a false-positive rate of 0.0054. Comparative analysis confirms that while Random Forest is accurate, Hetero-MLP reduces parameters by 25.4× versus standard GAT models. The proposed approach balances detection depth with edge constraints, offering scalable critical infrastructure protection.

1. Introduction

The current state of development for global information and communication technology infrastructure is typified by a thus far largely unstoppable growth process for the IoT. The latter is becoming increasingly prominent in a role definition process with regard to establishing itself at a base level for critical infrastructure support. Examples here include Smart Energy Grids, Water Supply Infrastructure, Industry 4.0 Operations, Autonomous Transport Systems, and Digital Healthcare Infrastructures [1,2]. Ubiquitous digital transformation has resulted in complex cyber-physical environments where the distinction between virtual and physical domains is increasingly indistinguishable. Analytical forecasts indicate that 22 billion connected IoT devices will be in operation by 2026, expanding to over 40 billion by 2034, creating an expansive attack surface that demands automated and scalable security solutions [3].

However, the difficulty of maintaining information security in this sector is further compounded by the resource disparity that presently exists between the capabilities of such endpoint devices in terms of functionality and security. Normally, edge devices in the network, such as sensors, smart meters, and actuators, are built with a special focus on enhanced energy savings and reduced costs. As such, such devices are limited by very significant hardware resource constraints in terms of CPU processing capabilities, RAM, and processing power. These resource constraints make it difficult to support such devices with the required antivirus protection capabilities, IPS, and even NGFWs, which all require high computational powers in deep content inspection (DPI) analysis [4,5].

In this context, the development of botnets with a systematically evolved structure of a network of compromised machines under centralized control from a unique command and control (C&C) center emerges as a serious threat. The recent generation of botnets, including Mirai, Mozi, Gafgyt, and Echobot botnets, reflects a paradigm shift from simple self-replication systems to a multi-path approach for vulnerability exploitation. Modern bots use the communication protocols of target devices, such as Telnet, HTTP, MQTT, and CoAP communication protocols, and make use of DDoS attacks with an objective of distributed reconnaissance, port scanning, and exfiltration of confidential information [6,7]. Assessments of existing network conditions confirm that botnets today are being used actively as a tool for massive attacks on communication backbone links and trust services, with malicious traffic possibly exceeding 90% of overall traffic during peak loads.

The current detection systems, which protect cloud storage and corporate network cores, operate through centralized data processing systems, but they experience slow detection times and poor performance when detecting spread-out security threats. The process of sending all network telemetry data from numerous IoT sensors to a single central server creates an excessive communication burden. This results in dangerous delays that real-time systems cannot accept. The situation demands an immediate transformation of network operations, which should move intelligent analysis and detection capabilities to edge computing through deployment on intelligent gateways, routers, and local controllers [2,8]. Comparative analysis against non-graph baselines (Logistic Regression, Random Forest) reveals that while Random Forest achieves high accuracy on flat feature sets, it lacks the relational context needed for heterogeneous environments. In contrast, the proposed Hetero-MLP (Edge) provides a $25.4\times$ reduction in parameter storage compared to standard GAT architectures while maintaining superior macro-level detection resolution ($F{1}_{Macro}=0.8026$) for protocol-specific anomalies [7,9,10].

GNNs have introduced a new way to analyze network security through their ability to represent traffic as dynamic graphs [2,11], theoretically enabling the capture of group-level coordination patterns that are often invisible to traditional point-based analysis [12,13]. However, direct application of standard GNNs on edge devices is hindered by the memory complexity of adjacency matrix storage. To address this, our approach transforms the graph learning problem into a context-aware inductive task. Instead of explicitly maintaining the graph topology V (IP identifiers) in memory, which can lead to overfitting specific network layouts, the proposed framework models edges E (communication flows) as independent entities enriched with heterogeneous protocol embeddings. Although GNNs theoretically allow for detecting coordinated botnet patterns via neighborhood aggregation (message passing) [12,13], this mechanism introduces prohibitive latency on microcontrollers. Standard GNNs require recursive neighbor queries, which creates a computational bottleneck during real-time traffic analysis. Therefore, our method aims to approximate this relational context using lightweight embeddings without the runtime cost of graph convolution. Research in [2,9] demonstrates that graph-based models outperform traditional temporal architectures like LSTM and spatial models like CNN in multi-stage attack detection, as they preserve the underlying network topology and relational dependencies often ignored by non-relational neural networks.

Real-world edge-level cyber defense systems face a major obstacle because GNNs require extensive computational resources and memory, which prevents their widespread use. The power needed for GCN and GAT to operate their convolutional functions and hold adjacency matrices becomes particularly high when dealing with many nodes and extensive edge networks [1,14]. The majority of existing solutions treat network graphs as uniform structures, which apply the same filtering process to all connection types.

Network traffic in real-world situations contains various types of semantic information, which appear throughout its data stream. The TCP protocol, which establishes connections and guarantees delivery, operates through different logic, timing, and header structure than the transportless UDP protocol and the service ICMP [9,15]. The failure to recognize this diversity results in the loss of vital contextual details. This makes models less accurate when they need to identify complex anomalies that appear as particular protocol operations.

The research aims to solve the basic conflict that arises from the GNN system’s high computational needs for detecting current botnets and the restricted processing capacity of IoT devices. The NF-BoT-IoT-v2 dataset exhibits a highly concentrated topology, comprising only 20 source and 291 destination IP identifiers across 37.7 million flows. To prevent the model from memorizing specific host identities (overfitting to the topology), source and destination IP addresses were explicitly excluded from the feature set. Instead, the model relies on protocol-agnostic identifiers (e.g., L4 ports) and flow statistics. Additionally, the inherent class imbalance (e.g., ‘Theft’ constitutes only 0.0064% of samples) necessitates a specialized weighted cross-entropy objective to maintain detection sensitivity [9,15,16]. This work introduces a Lightweight Heterogeneous Neural Network (Het-NN) framework designed for edge deployment. To satisfy stringent real-time constraints, we propose a transformation of the graph-learning task: we decouple structural feature extraction from the inference process. The proposed ‘Hetero-MLP’ architecture utilizes a heterogeneous schema where edges denote communication flows, but substitutes computationally expensive message passing with learned protocol embeddings and dense layers. This approach preserves the relational context of the graph structure during training while enabling single-pass inference compatible with microcontroller constraints.

The research achieves two major objectives through its scientific discovery, which brings value to practical implementation because it develops a novel heterogeneous traffic modeling approach based on NetFlow data representation through high-resolution heterogeneous graphs. The proposed architecture effectively models semantic and logical protocol disparities by projecting categorical features into a low-dimensional embedding space, which is then processed as an inductive operator, avoiding the heavy aggregation costs of standard GNNs. The original lightweight architecture of Hetero-MLP (Edge) achieves its goals through a combination of graph model topological understanding with the fast processing abilities of multi-level perceptrons. Post-training 8-bit quantization reduces the model footprint from 23.27 KB to 12.17 KB (a $1.91\times$ compression ratio), enabling autonomous deployment on resource-constrained ARM Cortex-M7 platforms (Arm Ltd., Cambridge, UK). For post-training 8-bit quantization, we employ a dedicated calibration subset comprising 10% of the training data, sampled to preserve the original class distribution. This calibration subset is strictly disjoint from the validation and test partitions to prevent information leakage. During calibration, representative batches of raw flow features are propagated through the floating-point model to estimate activation ranges, which are subsequently used to derive quantization scales and zero-points for all layers. Throughput evaluation via the TensorFlow Lite Micro toolchain (integrated with TensorFlow 2.20.0, Google LLC, Mountain View, CA, USA) confirms a processing capacity of 37,093 requests per second. Here, a ‘request’ is strictly defined as a single NetFlow v9 record (comprising 13 extracted features and the protocol type). While the single-inference latency averages ~16 ms due to Python (version 3.13, Python Software Foundation, Wilmington, DE, USA) interpreter overhead, the reported throughput is amortized over a pipeline with a batch size of 4096. This batch processing approach accounts for input buffer fetching, tensor preprocessing, and output serialization, effectively reducing the per-flow processing time to ~0.027 ms under high-load saturation conditions.

The proposed implementation of Weighted Categorical Cross-Entropy enables the IoTGuard framework to effectively mitigate extreme class imbalance, achieving an F1-score of 0.9943 for DDoS detection even when benign traffic constitutes only 0.35% of the dataset. The proposed approach demonstrated its superiority because it achieved the best balance between accuracy, speed, and memory usage according to a complete experimental evaluation. This evaluation used the contemporary NF-BoT-IoT-v2 dataset. Experimental validation on the NF-BoT-IoT-v2 dataset demonstrates that the Hetero-MLP (Edge) architecture significantly reduces parameter storage requirements compared to standard GAT and GCN models while maintaining high-speed real-time processing. This optimization facilitates the deployment of autonomous intrusion detection systems on resource-constrained ARM Cortex-M7 microcontrollers (Arm Ltd., Cambridge, UK) operating at 400 MHz.

The developed model requires integration with present-day Fog Computing systems because its intelligent analysis capabilities operate through multiple network levels in these systems. The proposed model functions as a first line of defense because it provides immediate access-level protection, which blocks large-scale botnet attacks at the start of their execution. The system serves as a defense mechanism that protects smart city and digital enterprise services by blocking attacks that would otherwise make these services unavailable and jeopardize their integrity. The system development process began as a reaction to worldwide cybersecurity threats. These need quick responses and self-directed defense systems to fight digital threats in fast-changing technological systems.

Feature selection is critical for minimizing the computational footprint on edge hardware. Dimensionality reduction was performed using Pearson correlation analysis to filter out redundant features (multicollinearity > 0.95) and select the top-13 attributes with the highest correlation to the target class. This selection methodology minimizes the computational footprint while retaining critical decision boundaries. This reduced feature set provides an optimal balance between information content and processing latency, allowing the model to capture essential topological and temporal indicators without the overhead of full packet inspection.

The developed Hetero-MLP (Edge) architecture solves the power consumption problem, which IoT devices face because they operate on self-generated power. The security of network nodes remains intact when floating-point operations decrease, together with memory access reduction, because this approach extends their operational period. The study results provide essential knowledge that advances graph learning theory development for cybersecurity, and they offer immediate advantages to embedded system developers and critical information infrastructure protection engineers.

The proposed IoTGuard methodology establishes a foundation for developing intrusion detection systems that integrate advanced relational learning with hardware-agnostic optimization. The model operates as a scalable defense mechanism, capable of adapting to various IoT equipment types within resource-constrained environments. This protects the digital society from increasing cyber threats while supporting its sustainable growth.

2. Related Work

The current scientific paradigm in the development of intelligent IDS for the IoT ecosystem is characterized by a fundamental shift from analyzing isolated network events to complex modeling of topological relationships. Traditional machine learning algorithms, such as Random Forest, demonstrate high detection accuracy on flat tabular data but lack the capability to model complex topological dependencies inherent in distributed botnets. While GNNs effectively address this limitation by aggregating features from local neighborhoods, their computational complexity (specifically, recursive message passing) renders them unsuitable for resource-constrained edge devices. A systematic review of literature from 2024 to 2025 indicates a critical gap: while graph-based architectures achieve superior detection resolution, their practical deployment is often prohibited by the strict SRAM (<32 KB) and latency limitations of edge-tier hardware [12,16].

The fundamental study by Siwar Rekik and Sajid Mehmood [16] presents the most complete development of dynamic graph architectures for detecting anomalies through their proposed hybrid model, which combines GNNs with Neural ODEs. The authors view network traffic as a continuous dynamic system, which enables their model to adjust when SDN topologies change while maintaining strong protection against concept drift. The system uses Neural ODEs to estimate node state variations, which occur continuously throughout time because IoT networks send data at unpredictable intervals. The DIGNN-A architecture developed by Jizhao Liu and Minghao Guo [12] implements graph convolution operations to process dynamic data structures through real-time mechanisms for handling temporal information. The model [12] employs the sliding window technique to analyze graph structures, which enables the detection of time-based relationships between consecutive communication activities. Iterative solving of ordinary differential equations (ODEs) in [16] and the high frequency of adjacency matrix updates in [12] introduce significant computational latency, exceeding the 10 ms real-time threshold for IoT saturation attacks. In contrast, the proposed IoTGuard framework eliminates the need for dynamic adjacency matrix maintenance entirely. Our approach replaces global structural updates with static heterogeneous embeddings. This architectural shift allows reducing the amortized per-flow inference time to sub-millisecond levels (<0.03 ms) via batched execution, significantly outperforming dynamic GNNs that struggle to meet the 10 ms real-time threshold due to recursive neighbor aggregation. Additionally, the study by William Villegas-Ch et al. in [9] develops the idea of dynamic modeling by building graphs based on NetFlow data, where each session is represented as a temporary edge. A critical limitation in [9,15] is the reliance on homogeneous graph structures, which treat all edges identically regardless of the underlying protocol. This masking of semantics reduces the ability to detect protocol-specific anomalies, such as distinguishing between normal DNS traffic and UDP amplification attacks. Our approach addresses this by employing specialized embedding spaces (d = 8) to encode protocol types as distinct, learnable vectors, thereby preserving semantic heterogeneity within a compact representation.

The issue of relational modeling and identification of malicious hosts in intranets is discussed in detail in the study by Haochen Xu et al. The authors propose an RE-GCN architecture that focuses on specific types of node interaction, proving that analyzing relational characteristics (e.g., the role of a node as a server or client) allows for more accurate identification of intranet threats than conventional GCNs. To build on this idea, Abdelkabir Rouagubi et al. applied relational GNNs to the task of firmware attestation in IoT swarms [4]. Their approach uses physical features—static random access memory (SRAM) data as unique device fingerprints (PUFs) that are integrated into graph embeddings. This demonstrates the promise of combining hardware features with neural network models to identify compromised nodes in large swarms of devices. However, the parameter count and runtime memory overhead in [4,17] exceed the strict 128 KB SRAM budget typical for ARM Cortex-M microcontrollers (Arm Ltd., Cambridge, UK), necessitating more aggressive model compression or architectural optimization.

A separate vector of modern research is the integration of spectral analysis and attention mechanisms to improve detection accuracy in high noise conditions. Mohan H G et al. [13] proposed a complex combination of spectral and spatial layers with a modified attention mechanism in their GrMA-CNN. The spectral component allows for analyzing the global structure of the graph through the eigenvalues of the Laplace matrix, which helps to detect distributed botnets. However, spectral convolution is characterized by a computational complexity of O(n³), which makes it virtually impossible to scale to industrial IoT networks without using super-powerful server GPUs. To mitigate computational complexity, Junyi Liu et al. [1] proposed DLG-IDS, which utilizes Large Language Models (LLMs) to generate semantic embeddings from industrial protocol logs; however, the memory footprint of LLM-based encoders remains incompatible with direct on-device execution [1,18]. A similar approach using a specialized CyberBERT model is described by Jaime Govea et al. in [18] within a federated architecture. Despite the impressive F1-score, the use of LLM processors or heavy Transformer blocks requires gigabytes of RAM, which automatically excludes the possibility of deploying such solutions directly to microcontrollers such as ESP32 (Espressif Systems, Shanghai, China) or STM32 (STMicroelectronics, Geneva, Switzerland).

To solve large-scale problems in IoT networks, Lihua Yin et al. proposed the use of the GraphSAINT subgraph sampling method in combination with the Graph Isomorphism Network (GIN) [11]. Their approach allows the model to be trained on representative parts of the graph, which reduces memory requirements during training. However, the final GIN architecture still requires hundreds of kilobytes of RAM to store node states during inference. In the context of edge optimization, the work of Riko Luša et al. in [14], which is devoted to the TE-G-SAGE model, is of particular interest. The authors integrated SHAP values (SHapley Additive exPlanations) to ensure the explainability of the system’s conclusions (Explainable AI) and applied temporal aggregation based on the GraphSAGE architecture. Although TE-G-SAGE is a step towards edge-oriented systems, its size still exceeds the critical limits for many classes of embedded systems requiring models of up to 20–30 KB in size.

The Federated Learning (FL) paradigm, combined with GNNs, is being actively developed as a means of ensuring data privacy in geographically distributed environments. Heeyong Yoon et al. proposed a universal framework for arbitrary spatio-temporal GNNs in a federated setting [2]. In turn, Fouad Al Tfaily et al. developed this idea in the FedGATSage architecture, which combines client GAT networks (Graph Attention) with server aggregation through community abstractions. This allows for a local attack surface to be maintained at each edge node without transferring raw traffic to the cloud. The hybrid methods presented by Jatinder Pal Singh and Rafaqat Kazmi [6] integrate FL with bio-inspired algorithms (PSO, GA) for feature selection, which allows for reducing the dimensionality of the input data somewhat. However, the main disadvantage of these approaches [2,6,8] is the significant communication load during the iterative transfer of graph layer parameters, which is critical for edge devices with low bandwidth.

An important challenge for graph-based IDSs is resilience to unbalanced sampling, which is an organic feature of real network traffic, where the share of attacks is a tiny percentage of the total volume. Hongbo Zhao et al. proposed the HGAA (Heterogeneous Graph Adaptive Augmentation) method [15], which uses adaptive augmentation of heterogeneous graphs. The model [15] generates synthetic edges for minority classes, which allows the robustness of training to be increased. The issue of statistical modeling of anomalies is raised in K. Dhana Sree Devi et al. [19] (WADCS model), where the integration of the Weibull distribution into the attention mechanism allows an accuracy of 94.09% to be achieved in Smart Grid networks. The use of the Weibull distribution helps to model the ‘tails’ of the traffic distribution, where rare anomalies are usually hidden. However, the complexity of the AWPE (Adaptive Weibull Parameter Estimation) mathematical apparatus in [19] requires significant floating-point calculations, which slow down work on edge devices without an FPU.

Recent approaches to feature selection and architectural search are also showing some progress. While [7,10] utilize meta-heuristic approaches, they often overlook the redundancy inherent in high-dimensional traffic data. Building upon the standardized feature sets established in [10], we applied Pearson correlation analysis to rigorously select the top 13 attributes (including TTL and Flow Duration). This method ensures multicollinearity reduction and provides an optimal balance between information entropy and low-precision computational complexity, specifically for ARM-based architectures. At the same time, Yamuna Raju et al. proposed adaptive learning strategies based on Kolmogorov–Arnold networks (KANs) as an alternative to traditional MLPs [20]. KAN models potentially require fewer parameters to approximate complex functions, but their implementation for graph structures is still at the stage of early experiments. On the other hand, Jean Rosemond Dora et al. [5] propose lightweight behavioral frameworks based on semantic analysis of in-memory code execution. Although the solutions in [5] are extremely lightweight, they focus on a narrow class of attacks and lose the ability to detect topological patterns of complex distributed botnets operating at the network communication level.

A fundamental analysis of works based on the standardized NetFlow feature sets, substantiated by Mohanad Sarhan et al. in [10], shows a steady trend towards the use of the NF-BoT-IoT-v2 dataset [21]. The dataset stands as the top representation of modern research because it includes 43 features and contains more than 37 million records, which enable researchers to model complex topological scenarios. Despite extensive research, few studies focus on extreme optimization for heterogeneous graph models. Current literature prioritizes maximum detection accuracy through high-parameter architectures, often neglecting the hardware-specific constraints and runtime execution costs of embedded IoT gateways [10,14].

The need for solutions that combine protocol semantics with traffic structural features exists as an immediate requirement for systems operating below 20 KB. Although ensemble baselines like Random Forest achieve low false-positive rates, their memory footprint often exceeds the capacity of microcontrollers, hindering autonomous deployment. Conversely, standard GNNs suffer from significant latency during inference due to adjacency matrix operations. This necessitates the development of a lightweight heterogeneous architecture, which leverages protocol-aware categorical embeddings to capture semantic relationships without the runtime overhead of iterative neighborhood aggregation. The proposed approach reconciles the contextual depth of heterogeneous modeling with the execution speed of linear operators, specifically targeting the constraints of ARM-based IoT gateways. The proposed architecture reconciles the relational depth of graphical analysis with the execution speed of linear operators. By encoding protocol semantics as inductive biases, IoTGuard provides a deterministic protection mechanism that remains stable under extreme class imbalance, specifically for the minority ‘Theft’ vectors identified as a common failure point in [15,19].

The review gives special recognition to Explainable AI papers because critical infrastructures need to detect attacks while understanding their operational methods. Paper [14] proves that the integration of SHAP values allows for the visualization of the contribution of each edge to the final output of the model. This opens the way to building systems where the edge node can send a concise and understandable incident report to the central control node. However, the real-time calculation of SHAP-based explanations during inference poses a significant computational overhead, which currently precludes its integration into latency-sensitive edge protection systems [14]. Architectural solutions need to incorporate interpretability as a fundamental element, which should exist within the layer structure instead of being added through post-processing techniques.

The present research landscape has enabled the development of high-performance graph-based IDS, but the edge deployment technology stack requires significant enhancement. Most authors focus on the use of homogeneous graphs, which eliminates the difference between TCP and UDP flows, although this difference is the key to detecting anomalous botnet patterns. The research proposed in this paper aims to fill this gap by developing an architecture that combines the semantic depth of heterogeneous protocol encodings with the computational lightness required for autonomous operation in real-world IoT networks.

3. Materials and Methods

The design process for a lightweight heterogeneous neural architecture combines graph-theoretic feature extraction with efficient deep learning inference [2,8]. The research focuses on the strategic transformation of network flow data: while we conceptualize the traffic as a heterogeneous graph to understand connectivity—a critical requirement for detecting modern botnet coordination [11,13]—the inference model itself (“Hetero-MLP”) operates on graph-informed edge vectors. This approach replaces computationally expensive message passing with learned categorical embeddings, ensuring compatibility with the strict latency constraints of edge hardware. The development pipeline proceeds from dynamic feature extraction to latent protocol embedding, culminating in post-training quantization for deployment on resource-constrained microcontrollers, validated against recent edge-optimization benchmarks [7,14].

To establish mathematical precision, we formally define the learning task not on the global graph topology $G=\left(V,E\right)$, but on the set of localized flow edges E. While traditional GNNs require the explicit node set V (IP identifiers) for message passing, our approach operates under the assumption of topological agnosticism. To prevent the model from memorizing the specific network layout (overfitting to the 20 unique source IPs), explicit IP identifiers are excluded from the input space. Each flow $e \in E$ is treated as an independent sample represented by a feature vector comprising 13 statistical NetFlow v2 attributes (e.g., ports, TTL, throughput) and categorical protocol indicators. The model relies on flow-level structural invariance, using transport-layer behaviors to generalize across different network environments.

In contrast to standard GNNs that perform iterative message passing over an explicit adjacency matrix, IoTGuard uses the Hetero-MLP as a lightweight local inductive operator acting at the edge level. During inference, every flow is processed in a single forward pass that concatenates numerical features $x_{num}$ with learned protocol embeddings $x_{cat}$:

$$h_e=\mathsf{\sigma }\left(W\cdot \left[x_{num}\parallel \mathrm{Embed}\left(x_{cat}\right)\right]+b\right),$$

which avoids global neighbor aggregation and effectively eliminates the runtime memory overhead of storing full graph states. This approach maintains a constant model complexity of $O\left(1\right)$ with respect to the graph size, ensuring real-time performance on resource-constrained edge devices.

The NF-BoT-IoT-v2 dataset serves as the main foundation that supports both experimental research and neural network model training because it represents a modernized version of the BoT-IoT dataset, which now exists in NetFlow v2 format [10,21]. The study employs this dataset because it contains more than 37 million records, which represent the typical structures of contemporary IoT networks that function under the edge computing architecture. The NetFlow v2 format provides an advantage for edge computing because it reduces the number of input data dimensions while preserving all essential network event information. The NetFlow format performs operations on flow metadata instead of requiring resource-intensive analysis of raw packets (pcap files). These require substantial computing resources to conduct DPI [10]. The system achieves ten-times-faster feature aggregation because it performs this operation at the network gateway, which enables traffic processing at physical communication channel speed.

Table 1. Quantitative scale and topological characteristics of the NF-BoT-IoT-v2 dataset.

Parameter	Value
Total Samples	37,763,497
Total Features	43
Benign Samples	135,037
Attack Samples	37,628,460
Unique Sources	20
Unique Dest	291

shows the complete quantitative and structural characteristics, which describe the network environment that has been modeled.

The dataset exhibits a significant topological concentration, where a limited set of 20 unique source IPs and 291 destination IPs generate the entirety of the 37 million recorded flow events. This distribution reflects the characteristic hierarchical architecture of contemporary IoT ecosystems, where high-density sensor and actuator traffic converges onto a restricted number of aggregation points and cloud gateways [4,5]. This topology stems from a controlled BoT-IoT lab environment in which a fixed pool of compromised endpoints continuously generates high-volume traffic towards a limited number of aggregation gateways and cloud services. As a result, a very small set of IP identifiers produces a massive number of flows, which is atypical for public backbone traffic but representative for stressed IoT segments in saturation-attack scenarios.

The global NF-BoT-IoT-v2 dataset contains 2431 Theft flows, corresponding to 0.0064% of all 37,763,497 records. In contrast, the 15% stratified test split used for evaluation includes 364 previously unseen Theft samples. All per-class metrics reported in the Results section, including the F1-score of 0.2834 for Theft, are computed exclusively on this test partition. By exploiting this topological density, the proposed graph modeling approach facilitates the construction of compact adjacency representations, effectively minimizing the memory overhead and storage requirements typically associated with sparse network graphs. A primary challenge identified in this study is the extreme class imbalance (

Table 2. Detailed traffic class distribution and extreme imbalance analysis.

Attack	Count	Percentage (%)
DDoS	18,331,847	48.5438
DoS	16,673,183	44.1516
Reconnaissance	2,620,999	6.9406
Benign	135,037	0.3576
Theft	2431	0.0064

), which risks biasing the model towards dominant attack vectors and necessitates specialized loss weighting to maintain detection resolution for minority classes.

Statistical analysis confirms a severe class imbalance; the global NF-BoT-IoT-v2 dataset contains 2431 ‘Theft’ samples (0.0064%). To ensure a rigorous and unbiased evaluation,

Table 3. The effectiveness of the complex metrics depends on the existence of the categories.

Category	Accuracy (One-Vs-Rest)	F1-Score	FPR	Samples
DDoS	0.9945	0.9943	0.0054	2,749,777
DoS	0.9769	0.9735	0.0106	2,500,978
Reconnaissance	0.9818	0.8776	0.0152	393,150
Theft	0.9997	0.2834	0.0003	364

reports metrics calculated on a stratified 15% test partition, where the ‘Theft’ class is represented by 364 unseen samples. All models (Hetero-MLP Edge, standard GAT, standard GCN, and non-graph baselines such as Logistic Regression and Random Forest) were trained and evaluated on identical NF-BoT-IoT-v2 splits and feature sets under the same preprocessing and evaluation protocol, unless explicitly stated otherwise. Furthermore, the concentration of flow events within a small subset of source IPs is a direct consequence of the controlled BoT-IoT lab environment topology, which was specifically designed to simulate high-intensity attack scenarios from a fixed set of compromised endpoints.

The analysis of the categorical distribution indicates that legitimate traffic (Benign) makes up a critically small share—only 0.36% of the total data set, while DDoS (48.54%) and DoS (44.15%) attack vectors actually dominate the sample, covering more than 92% of all traffic. The training process needs special approaches to balance loss functions because of the extreme class distribution, which helps the model avoid developing majority class bias while maintaining alertness to uncommon anomalies [15]. The descriptive statistics of essential features demonstrated wide variations in time-based and amount-based measurements, which validates the intricate design of current threat architectures. The network flow shows an average duration of about $3.99\times {10}^6$ milliseconds, but it experiences large fluctuations because of the $1.08\times {10}^6$ millisecond standard deviation, which proves that the system contains both short DDoS flooding attacks and extended bot command operations. The average throughput, which connects source to destination, operates at 590,522 bps, but the system achieves its highest peak values at $3.84\times {10}^9$ bps. The data shows such extreme value differences across multiple magnitude levels that logarithmic scaling, together with robust normalization techniques, needs to be applied before neural network input to maintain gradient descent stability and avoid activation function saturation.

The analysis of network protocol distribution in the dataset revealed a complex network traffic pattern, which served as the base for constructing the proposed model. The majority of network traffic is split evenly between two core transport protocols, which include TCP at 51.4% (19.41 million records) and UDP at 48.6% (18.35 million records). The total data includes less than 0.01% from ICMP and specialized industry add-ons, which function as statistical noise that does not affect the model’s architectural design. Standard homogeneous feature processing remains unusable because the distribution prevents users from treating all flows as equal vectors. The TCP protocol functions as a connection-establishment system that focuses on reliability, so its state flags (SYN, ACK, FIN) and transmission window sizes perform different security functions than the UDP protocol, which operates without a transport layer to deliver data quickly but does not ensure delivery. The architecture contains a Categorical Embedding layer [9,15] which handles semantic differences between these elements.

Our approach replaces the traditional One-Hot coding method, which produces sparse vectors with high dimensionality and causes computational costs to rise in direct relation to category numbers. The protocol type information flows through the system by means of a condensed latent space representation, which operates at a reduced dimensionality level. The mathematical formalization of this process is as follows: let P be a categorical feature of the protocol that takes discrete values from the set $\{TCP, UDP, ICMP, \dots \}$. The embedding layer uses a parameterized nonlinear mapping function that transforms $f:P\to R^d$. The research team empirically determined that a d = 8 embedding vector provides the optimal trade-off between semantic richness and memory efficiency. Preliminary ablation tests indicated that increasing d beyond 8 yielded marginal gains in F1 score (<0.1%) while significantly increasing the parameter count, which is critical for 20–30 KB memory constraints. The training process converts each protocol i into the vector $E_i=\left[e_{i,1},e_{i,2},\dots ,e_{i,d}\right]$. The backward error propagation process uses weight adjustment to bring together protocols that display identical anomalous behavior patterns in latent space. The integration of different systems reaches its final stage when the embedding vector E joins with the preprocessed numerical features vector $X_{num}$ o create the final representation, which exists as $X_{fusion}=\left[X_{num}\parallel E_{proto}\right]$. The neural network in the following hierarchical layers adjusts its internal weights through automatic processes based on protocol context, which delivers the lightweight property because the protocol’s entire semantic complexity condenses into 8 parameters instead of expanding the input layer.

The data transformation pipeline converts raw NetFlow records into vectorized representations suitable for the Hetero-MLP inference engine. Unlike graph-based approaches that require the construction of an adjacency matrix A and mapping of unique IP identifiers to node indices $V_{src},V_{dst}$, our pipeline bypasses topological reconstruction. Each raw NetFlow record is directly mapped to a feature vector $x\in R^{13}$. The categorical protocol field is isolated for the embedding branch, while numerical attributes (duration, bytes, packets) undergo normalization. This stateless processing ensures that the system does not need to maintain a global graph state or history of interactions in memory, significantly reducing the runtime overhead compared to dynamic graph updates described in [12,16].

Feature selection was performed using Pearson Correlation Analysis to identify the Top 13 attributes that maximize the correlation with the target class label while minimizing inter-feature redundancy [7,10]. Specifically, features such as MAX_TTL ($r \approx 0.146$) and MIN_TTL were retained due to their ability to expose botnet packet generation artifacts. This statistical filter method was chosen over wrapper methods to reduce pre-processing overhead on the edge device, ensuring that only the most discriminative flow attributes are passed to the input layer. The maximum and minimum TTL (Time-To-Live) values demonstrated the strongest correlation coefficient ($r \approx 0.1459$) because botnets employ particular packet generation methods for DDoS attacks, which involve using either fixed or unusual TTL values to hide their network structure. The final list of features contains information about how long incoming flows last and the port numbers that sources and destinations use, the amount of bytes and packets that travel in both directions, the TCP flag settings, the total flow duration measured in milliseconds, and the smallest and largest packet dimensions found within the flow. The dimensionality reduction process enabled us to decrease the network input layer free parameters by over three times, which represents a fundamental requirement for achieving stable deployment on edge-level resources.

The methodology focuses on the intelligent processing of anomalous values and statistical outliers, which receive special attention. The initial evaluation revealed that TCP client-side flags, together with other features, experience outlier occurrences that reach 3.58%. The standard statistical analysis approach requires analysts to remove or limit these values for model stability, but cybersecurity professionals need to study these unusual data points because they represent specific patterns that indicate cyber attacks. To ensure robust convergence and prevent gradient saturation, numerical features are standardized using Z-score normalization based on the global training set statistics:

$$x^{\prime }={\displaystyle \frac{x-{\mu }_{train}}{{\sigma }_{train}}}$$

where ${\mathsf{\mu }}_{train}$ and ${\mathsf{\sigma }}_{train}$ are the mean and standard deviation calculated over the entire training partition. This ensures that the input distribution is centered for the neural network, preventing features with large magnitudes (e.g., Flow Duration) from dominating the gradient descent process.

The proposed Hetero-MLP (Edge) neural network architecture employs a series of dense layers that include $L_2$ norm-based regularization to stop the model from learning too much when there are not enough authentic samples [7,20]. The mathematical formalization of signal processing in the hidden layers of the model is presented as follows:

$$H^{\left(l\right)}=\mathsf{\sigma }\left(W^{\left(l\right)}{H}^{\left(l-1\right)}+b^{\left(l\right)}\right)$$

where $\mathsf{\sigma }$ is the ReLU (Rectified Linear Unit), which functions as the nonlinear activation system because it provides both operational speed and efficient performance for edge computing systems. The weight matrix from the l-th layer called $W^{\left(l\right)}$ undergoes training with a penalty term that applies a $|W{|}_2^2$ regularization at a value of $\mathsf{\lambda }= 0.001$. The input layer takes in the combined vector $X_{fusion}$, while the embedding layer, which starts with normal distribution values, learns through gradient methods along with the main network weights during training. The final layer employs the Softmax function to create probability distributions. These represent the different categories of anomalies:

$$\widehat{y_j}={\displaystyle \frac{e^{z_j}}{{\sum }_{k=1}^C{e}^{z_k}}}$$

The variable C represents the total number of target attack classes, while z shows the output values that emerge from the last linear layer.

The learning algorithm works by minimizing the Weighted Categorical Cross-Entropy loss function, which enables the proper handling of strongly unbalanced dataset distributions. The mathematical derivation of the objective function includes the weighting coefficients that determine the value of each class in the calculation:

$$L=-{\displaystyle \frac{1}{N}}\sum _{i=1}^N\sum _{j=1}^C{w}_j{y}_{i,j}\log \left(\widehat{y_{i,j}}\right)$$

The batch size consists of N elements, while the weighting factor for each class j equals $w_j$, which is calculated by dividing the total sample size $w_j={\displaystyle \frac{N_{total}}{C \times n_j}}$. This cost-sensitive learning approach penalizes classification errors in the ‘Theft’ and ‘Benign’ categories more heavily, effectively mitigating the majority-class bias induced by the dominance of DoS and DDoS samples. The ReduceLROnPlateau adaptive mechanism helps the model reach steady convergence while preventing it from getting stuck in local minima because it decreases the learning rate by 5 times when the validation sample loss function stays flat for 5 epochs in a row. The EarlyStopping algorithm with a patience parameter of 10 epochs is also integrated, which allows the training process to end at the point of the model’s highest generalization ability, preventing the degradation of results on new data.

The final stage of the pipeline focuses on hardware-aware optimization for edge deployment [14]. We employed Post-Training Quantization (PTQ) to convert the model parameters from 32-bit floating-point (FP32) to 8-bit integer (INT8) representation. Mathematically, this affine transformation is defined as follows:

$$q=\mathrm{clamp}\left(\mathrm{round}\left({\displaystyle \frac{r}{S}}+Z\right),q_{min},q_{max}\right)$$

where r denotes the real value, S is the scale factor, and Z is the integer zero-point. This process reduces the model footprint from 23.27 KB (FP32) to 12.17 KB (INT8). To minimize quantization error, we utilized a representative calibration dataset (10% of training samples), strictly disjoint from the test set, to estimate dynamic activation ranges. The optimized model was deployed on a cycle-accurate emulation of an ARM Cortex-M7 core (400 MHz) (Arm Ltd., Cambridge, UK) using the TensorFlow Lite Micro interpreter (integrated with TensorFlow 2.20.0, Google LLC, Mountain View, CA, USA). The reported memory usage (12.17 KB) encompasses the total static RAM required for model weights, quantization parameters, and intermediate tensor buffers during a single forward pass. The integrated pipeline—from heterogeneous graph representation to hardware-level quantization—enables a deterministic cyber defense system capable of autonomous operation within the strict 20–30 KB memory limits of industrial IoT gateways.

The validation process requires special attention because it requires testing on devices that match the characteristics of actual edge nodes. The evaluation of inference latency is performed through ARM Cortex-M (Arm Ltd., Cambridge, UK) environment simulations, which helped us verify our calculated theoretical performance data. The basic data format of NetFlow v2 enables the IoTGuard model to operate under high traffic density conditions because deep packet analysis through traditional methods would result in critical system delays. This would cause device buffer overflows. The developed method creates a complete data processing system that starts by gathering network telemetry data and ends with network edge blocking of abnormal flows to defend against rapid, destructive, and botnet attacks.

The model facilitates the detection of complex attacks through its protocol encoding system, which captures semantic nuances of network behavior. Even without explicit topological links, the system identifies botnet activities (such as port scanning or flooding) by detecting specific anomalies in TTL profiles and flow statistics that are characteristic of automated scripts. By learning a dense representation of protocol headers, the Hetero-MLP distinguishes between legitimate high-load traffic and malicious saturation attacks based on intrinsic flow properties rather than network structure. The proposed model demonstrates improved resistance against evasion techniques that attempt to copy genuine traffic patterns. The mathematical accuracy of graph learning systems ensures reliable security operations in unregulated and ever-changing IoT network environments. The entire methodology process, from feature selection to final optimization, focused on achieving maximum Accuracy per Memory Unit. This resulted in the development of IoTGuard as a competitive solution for future infrastructure protection.

The pre-processing pipeline enforces strict topology sanitization: raw IP and MAC addresses are removed and are not replaced by unique node indices in the inference input. This ensures that the Hetero-MLP learns behavioral signatures (e.g., port scanning patterns, volume anomalies) rather than specific host identities. This design choice guarantees privacy and enables the model to generalize to new network segments without retraining. The system achieves scalability through this method. It enables fast deployment across various IoT environments without requiring time-consuming training for each node’s specific data. The IoTGuard framework provides a scalable and generalizable solution; while optimized for NetFlow v2, the categorical embedding layer can be adapted to accommodate raw packet headers or alternative flow formats, ensuring compatibility across diverse network deployments.

4. Results

We evaluated the Hetero-MLP (Edge) architecture to verify its capability to detect multi-vector botnet attacks under strict hardware constraints. This assessment focuses on validating the efficiency of heterogeneous protocol embeddings as a lightweight alternative to complex graph representations [2,8]. The experimental study addresses three critical dimensions required for edge-level security: (1) the stability of objective function convergence using weighted loss; (2) robustness against extreme class imbalance; and (3) the trade-off between inference throughput and memory footprint on the ARM Cortex-M7 platform (Arm Ltd., Cambridge, UK). To contextualize the results, we performed a comparative analysis against state-of-the-art GNNs (GAT, GCN) and lightweight non-graph baselines. Crucially, to ensure a fair comparison regarding hardware resource utilization, we applied the same 8-bit PTQ pipeline to the GNN baselines as used for our proposed model. This eliminates the bias of comparing optimized edge models against uncompressed reference implementations [10,11,16].

The training process required ongoing precision monitoring of loss functions and accuracy metrics, which used training and validation samples to develop a model that generalizes well to new data. This stopped overfitting. Deep models face a common challenge with overfitting when they process high-dimensional network data from NF-BoT-IoT-v2 because attackers hide their traffic patterns, which resemble authentic statistical relationships between network features [10,21]. We conducted a detailed mathematical assessment of training curves to determine the architecture convergence stability, which helped us find the best training duration and proved our multifactor regularization approach works well. Figure 1 illustrates the convergence of loss and accuracy metrics for both training and validation sets, confirming the stability of the gradient descent process.

The graphical data analysis demonstrates that gradient descent maintains stable performance while the regularization methods, which include $L_2$ weight penalization, prove to be effective. Optimal convergence was observed at epoch 41, where the delta between training and validation categorical cross-entropy stabilized below 0.002, indicating effective parameter tuning without overfitting. The system operates as expected because it has reached the global minimum of its objective function without showing signs of overfitting to the training data. The training process achieved its final stages without any major curve differences because the model achieved exceptional stability through its combination of regularization techniques and the ReduceLROnPlateau algorithm. This adjusts the training step adaptively. The latter method maintained a continuous reduction in learning rate, which solved the error plateau problem to enable the model to adjust parameters near the best solution. The neural network state at epoch 45 reached its highest generalization ability. The integrated early stopping method used this state to capture this state and prevent model adaptation to random statistical noise that exists in raw NetFlow data. Standard GNNs follow different convergence patterns because they experience gradient decay issues, and their node features become overly smoothed during deep graph structure information aggregation [13,14]. Our proposed model uses Hetero-MLP blocks instead of heavy iterative convolutions to maintain high feature resolution at a minimum depth of the architecture.

The quantitative evaluation of classification performance is summarized in Table 3, utilizing a One-vs-Rest (OvR) strategy to derive metrics for each attack category. Given the extreme imbalance of the NF-BoT-IoT-v2 dataset, the F1-score and False Positive Rate (FPR) are prioritized over overall accuracy. Researchers analyzed through representative sample analysis.

The proposed architecture demonstrates high sensitivity for DDoS detection, achieving an F1-score of 0.9943 with a low false-positive rate (FPR = 0.0054). This high precision is fundamental for ensuring reliable network operation and minimizing the disruption of legitimate traffic in critical IoT infrastructures. The classification system achieved a 0.9769 accuracy rate for DoS attack detection, which protects IoT infrastructure stability when facing aggressive, malicious network traffic. The Hetero-MLP architecture achieves its maximum performance through deployment across most of the target population because it can detect a large number of network traffic patterns. The system architecture proves its effectiveness because it identifies multiple particular patterns, which include both high request volume patterns and typical high throughput patterns with specific configuration settings through TCP and UDP protocols [9,15]. The embedding-layer system implementation has made it possible to distinguish protocol meanings through latent capacity. This produces better results than standard homogeneous models for transport layer logic analysis.

Performance on the minority ‘Theft’ class presents a known trade-off (F1-score = 0.2834). Given that this class constitutes only 0.0064% of the dataset (364 samples), the Weighted Cross-Entropy loss prioritized global stability for dominant threats (DDoS/DoS) over overfitting to these rare events. While this limits sensitivity for ‘Theft’, it prevents the generation of excessive false positives (FPR = 0.0003) for legitimate traffic, which is critical for autonomous blocking systems. Future iterations may address this via few-shot learning or generative augmentation [10,21].

The Confusion Matrix (Figure 2) illustrates the distribution of classification errors across categories. The analysis reveals that the primary source of confusion occurs between the DDoS and DoS classes due to their shared NetFlow metadata characteristics, such as high request frequency and similar packet sizes.

The matrix visualization shows that most classification errors occur between the DoS and DDoS threshold levels. The two types demonstrate identical physical and logical properties, which leads to a reasonable conclusion about their similarity. The two types of NetFlow-metadata allow for the extraction of identical resources. The two protocol ports, together with their respective packet characteristics, exist in identical form. Research has shown that 99.6% of legitimate traffic gets correctly identified. This represents a major academic achievement because traditional MLP models tend to confuse legitimate traffic with DoS attacks since they lack global context. The model maintains consistent performance when it comes to identifying different classes. The slight decrease in F1 score for the Reconnaissance class is attributed to the low data volume per session, which occasionally mimics benign baseline behavior during the initial scanning phases. The strong diagonal pattern in the confusion matrix confirms the model’s high classification reliability for dominant classes, serving as an effective real-time monitoring solution for network edge nodes.

The main goal of this research focused on validating the model’s performance under extreme real-time processing requirements, which needed to run on hardware systems with restricted computational abilities. The latency analysis for IoT systems took place on platforms that matched the performance of IoT gateways and integrated microcontrollers that demonstrated the process (see Figure 3).

Hardware validation in the simulated ARM Cortex-M7 (Arm Ltd., Cambridge, UK) environment demonstrates effective resource utilization. While the single-sample inference latency averages ~16 ms due to runtime overhead, the pipelined processing (batch size = 4096) achieves an amortized throughput of over 37,000 requests per second (

Table 4. A comparative analysis of the model’s dimensions and computational capacity is hereby presented.

Model	Acc	Memory (KB)	Throughput (req/s)
Proposed Hetero-MLP (Edge)	0.976	12.17	37,093
Standard GAT (Ref)	0.982	112.45	3150
Standard GCN (Ref)	0.975	76.80	4200

). This indicates that the Hetero-MLP (Edge) is well-suited for high-throughput buffered execution, minimizing jitter compared to the unpredictable recursive steps of standard GNNs [8,14].

The results confirm that even when state-of-the-art GNNs are subjected to identical quantization optimizations, the proposed Hetero-MLP architecture maintains a superior efficiency-to-performance ratio. Specifically, our model is 6.3× smaller than the quantized GCN and 9.2× smaller than the quantized GAT, while delivering an order-of-magnitude improvement in throughput. This efficiency is achieved by replacing iterative graph message-passing operations, which are computationally expensive even in INT8 format, with localized heterogeneous protocol embeddings [8,14].

Comparative analysis with baselines (

Table 5. Performance of lightweight non-graph baselines on the TOP-13 NetFlow features.

Model	Macro F1	Weighted F1	Memory Footprint (Disk)	Edge Deployment Status
Logistic Regression (TOP-13)	0.6487	0.9611	1.24 KB	Feasible (Low Sensitivity)
Random Forest (TOP-13)	0.9695	0.9996	31,555.89 KB	Impractical (Exceeds Flash)

) reveals a critical architectural trade-off. While Random Forest achieves superior detection accuracy (Weighted F1 = 0.9996), its deployment on microcontrollers is impractical: storing a robust ensemble of decision trees typically requires > 30 MB of storage (and significantly more RAM for execution), exceeding the capacity of standard IoT gateways. In contrast, the proposed Hetero-MLP (Edge) sacrifices marginal accuracy (<4%) to achieve a 12.17 KB footprint (INT8), enabling fully autonomous deployment.

To validate the impact of the quantization used in the comparative analysis above, we analyzed the specific degradation of our model when moving from FP32 to INT8. The PTQ reduced the model size from 23.27 KB (FP32) to 12.17 KB (INT8). As shown in

Table 6. Per-class F1 performance for full-precision and low-precision emulated variants.

Class	F1 (Full Precision)	F1 (Low Precision)	ΔF1 (pp)
Benign	0.8844	0.8851	+0.06
DDoS	0.9943	0.9943	0.00
DoS	0.9735	0.9735	0.00
Reconnaissance	0.8776	0.8776	−0.00
Theft	0.2834	0.2834	0.00
Macro Avg	0.8026	0.8028	+0.01

, this 1.91× compression incurred negligible performance loss.

Surprisingly, the macro-averaged F1-score increased marginally by +0.01 pp after quantization. The system maintains its unusual robustness because low precision functions as a regularization mechanism that removes insignificant floating-point weight fluctuations. The model requires 12.17 KB of memory, which occupies under ten percent of SRAM available on typical STM32 (STMicroelectronics, Geneva, Switzerland) and ESP32 (Espressif Systems, Shanghai, China) microcontrollers, while preserving enough memory space for core application code and network stack functions [7,14].

The Hetero-MLP system achieves GNN semantic depth approximation through protocol embedding integration, which avoids the O(N²) complexity that message passing requires. The model reaches 37 k requests per second throughput through its learnable embedding weight system, which replaces the runtime adjacency matrix approach for topological awareness. The system faces detection problems with its “Theft” class because of limited data availability, yet it achieves a low False-Positive Rate (0.0054 for DDoS) and Zero Trust compliance, which enables decentralized blocking of volumetric attacks without needing cloud infrastructure [6,8]. The Pearson correlation analysis showed that the Top-13 feature set maintains enough entropy for classification. This matches the results from studies about high-variance NetFlow attributes [7,10]. The model uses TTL and Flow Duration as strong indicators for botnet automation, which enables it to achieve benchmark results with fewer input requirements. The research shows that lightweight embedding-based models provide an effective alternative to heavy graph-based models for IoT systems, which have limited resources [11,14].

5. Discussion

The research shows that lightweight neural systems protect IoT edge zones by separating semantic feature extraction from their required topological connections. The Hetero-MLP (Edge) model operates through categorical protocol embeddings which replace the costly message passing and neighborhood aggregation process used by traditional GNNs [9,14]. The Hetero-MLP (Edge) model operates through categorical protocol embeddings which replace the costly message passing and neighborhood aggregation process used by traditional GNNs [9,14]. The model converts TCP and UDP protocol identifiers into an eight-dimensional dense latent vector, which allows it to understand core communication meanings without needing to use high-dimensional one-hot encoding or manage dynamic adjacency matrices. The design solves the main security problem because it produces different detection results for intricate botnet patterns while it removes the need for runtime graph reconstruction. Our method moves the topological analysis computation away from the inference stage to the training stage. This enables the deployed model to function at O(1) complexity when compared to network size [2,8].

To quantify the architectural efficiency, we utilize the Accuracy per Memory Unit (APMU) metric. The standard GAT baseline reaches an APMU of about 0.0087 (Accuracy/KB) through its structural overhead when all models receive INT8 quantization under the strict “fair comparison” regime. The Hetero-MLP (Edge) model achieves an APMU value of 0.0802, which shows 9.2-times-better resource usage efficiency. The validation shows that local inductive operations provide better results than global message aggregation when working with on-chip memory [7,14]. The quantized model footprint of 12.17 KB occupies less than 10% of the typical SRAM capacity found in ARM Cortex-M7 microcontrollers (Arm Ltd., Cambridge, UK) during deployment. The system achieves a throughput of 37,093 requests per second, which passes the real-time saturation attack mitigation needs while offering additional processing power to manage sudden traffic spikes. The TensorFlow Lite Micro (integrated with TensorFlow 2.20.0, Google LLC, Mountain View, CA, USA) system uses INT8 arithmetic to improve SIMD instruction performance when compared to GNN sparse operations. This should result in 40–60% energy savings from FP32 operations because it improves cache performance and reduces the number of memory access operations [5,8].

The proposed approach advances the field by demonstrating that protocol-aware embeddings can substitute complex temporal modeling in saturation attack scenarios. Theoretical models that use Neural ODEs [16] to describe continuous network dynamics offer better accuracy. Yet their computational demands prevent their use for real-time edge mitigation. Our results confirm that the Hetero-MLP maintains response latency in the millisecond range (amortized), ensuring the immediate blocking of high-speed DDoS flooding. Our system architecture delivers fixed latency, which allows dynamic graph models to operate with unsteady runtimes because safety-critical industrial control systems need this feature for their operation. The system achieves an equilibrium between “sufficient accuracy” and “extremely low computational cost,” which solves the major latency problems discovered in previous edge-AI studies [1,18].

The Hetero-MLP architecture provides a vital benefit because it can adapt to various types of systems that exist in different environments. The system enables transfer learning through its embedding-based design, which differs from traditional signature-based systems. The system requires only the lightweight embedding projection layers to undergo retraining for industrial protocol adaptation (Modbus and DNP3) while the core MLP weights remain frozen. This reduces the computational cost of on-device updates. The model solves deep learning black box problems because it provides its own interpretability through the structure of its embedding space. The learned vector representations help security administrators understand which protocol features lead to anomaly detection because GAT models’ multi-head attention mechanisms prevent them from understanding their decision process. The Zero Trust model achieves transparency because it allows network edge-based decision-making through decentralized systems, which operate independently from cloud access.

The study identifies particular research boundaries that define the model’s operational limits. The first step involves adding L4 source and destination ports as numerical data. This leads to protocol-specific memory storage instead of creating an abstract behavior model. The method works well in fixed IoT networks, which include SCADA systems and factory subnets, because their service arrangements stay constant. The method produces false alarms when used in business networks that experience changing port numbers and network address translation operations. The research needs to continue by developing port-independent feature engineering methods, which will replace current absolute value features with entropy-based metrics and protocol fingerprinting techniques [10]. The ‘Theft’ class presented only 0.0064% of the total flows, which caused the F1-score to drop to 0.2834 because weighted loss functions do not handle such infrequent anomalies properly. The current situation requires the immediate development of advanced data augmentation methods, which should include Few-Shot Learning and GAN-based data synthesis to better represent minority classes [21]. The ARM Cortex-M7 (Arm Ltd., Cambridge, UK) cycle-accurate emulation confirmed latency, but hardware testing with ESP32 (Espressif Systems, Shanghai, China) or STM32 (STMicroelectronics, Geneva, Switzerland) devices needs to be done for the complete measurement of actual power usage and operating system scheduler jitter effects on hardware.

6. Conclusions

The research investigates how edge-level botnet detection systems encounter a trade-off between their detection accuracy and the amount of computational resources they need to operate. Our Hetero-MLP (Edge) architecture introduced an optimized inductive operator that replaced the global message aggregation process that required substantial resources. The main contribution emerges from combining categorical protocol embeddings with NetFlow v2 attributes, which reveals complex coordination patterns without needing adjacency matrix storage or graph convolution iterations. The method enables graph-based logic deployment on IoT gateways. These have limited resources.

The complete experimental analysis of the massive NF-BoT-IoT-v2 dataset, which contains 37.7 million records, demonstrates the architectural efficiency of the proposed solution. The model footprint shrank to 12.17 KB after applying 8-bit post-training quantization (PTQ), which enables it to operate within SRAM limits of ARM Cortex-M7 microcontrollers (Arm Ltd., Cambridge, UK). The system delivers a fixed throughput of 37,093 requests per second, which surpasses the actual time needed to defend against saturation attacks. IoTGuard provides strong protection against volumetric threats through its detection quality, which achieves DDoS F1 = 0.9943 and FPR = 0.0054 to reduce false alarms in critical infrastructure. The Hetero-MLP model achieves an APMU ratio that exceeds standard GAT and GCN baselines by more than 13 times in memory efficiency. It maintains the same per-class detection resolution. The engineering team implemented INT8 arithmetic to achieve better hardware SIMD instruction performance because this approach should reduce energy use by 40 to 60 percent when compared to typical floating-point operations. The system operates continuously through battery power, which protects edge devices from operational lifespan reduction because of its design. The system allows devices to perform inference independently, which removes the need to send extensive telemetry data to central servers. The architectural transformation reduces network latency while it maintains data privacy and fulfills the security needs that Industry 5.0 cyber-physical systems require for autonomous operation.

The scientific field holds multiple strategic pathways that will direct its future growth. The primary vector is constituted by the implementation of extensive, long-term field tests of IoTGuard in real-world conditions, i.e., in a live network environment, on assets of the energy and public infrastructure sectors. This process enables the verification of the model’s stability with respect to the dynamic changes in the network landscape (concept drift) and its capacity for autonomous operation without additional training. The second vector is directed towards the integration of the designed lightweight architecture within the paradigm of Federated Learning. This approach enables decentralized groups of IoT devices to collectively enhance the global model for identifying abnormalities, facilitating the exchange of information, and ensuring the highest level of privacy and cybersecurity in future networks.

In particular, subsequent work will prioritize improving recall for the extreme minority Theft class by integrating few-shot learning strategies, GAN-based synthetic traffic generation, and federated learning under realistic edge deployment constraints. This is achieved by creating realistic, but monitored, examples of harmful activity in the NetFlow network. This combination of distinct, frequently unconventional models with a range of generic approaches enables the creation of a versatile detector capable of identifying both latent and targeted cyber threats.

A thorough review of the extant literature reveals that the extant study demonstrates a new standard in the field of edge-oriented network security. The capacity of the structural complexity of the graph neural networks with high processing power and the simplicity of the optimized MLP blocks is sufficient for the reliable, efficient and autonomous protection of the IoT environment. This is a critical step in the process of constructing resilient and self-defending cyber systems, where the primary function of the built-in security is to protect the system as a whole. The IoTGuard technology has been developed with the potential for commercialization and implementation in critical sectors of the contemporary digital economy.

The results of the work are of direct practical value to engineers and system designers, insofar as they provide a ready-made toolkit for the development of intelligent digital signal processors (IDS) on existing equipment without the need for costly modernization. The scientific novelty of the proposed model is evidenced by its exceptional capacity for both mobility and compactness, while maintaining the same level of precision as current models. This renders the proposed model a potential candidate for the development of sophisticated international research in the field of artificial intelligence for cybersecurity. Further research is required to expand the functionality of Explainable AI in the field of explainability. The aim of this research is twofold: firstly, to provide users with clear explanations of the reasons for any actions taken; and secondly, to increase the general level of trust in the functionality of machine learning systems in specific areas.