Edge AI Bridge: A Micro-Layer Intrusion Detection Architecture for Smart-City IoT Networks

Abstract

Smart-city IoT ecosystems depend on a large number of devices with limited resources, which often lack built-in security mechanisms. While traditional cloud-based or gateway-centric intrusion detection systems (IDSs) offer essential security, they are still characterized by high detection latency, considerable bandwidth demand, and a lack of precise monitoring of single device actions. This study proposes the Edge AI Bridge, a novel micro-computing security layer positioned between IoT devices and the gateway to enable early-stage threat interception. The architecture integrates embedded AI hardware with a hybrid pipeline, utilizing unsupervised anomaly detection for behavioral profiling and a lightweight signature-matching module to minimize false positives. System operations—including localized traffic inspection, protocol parsing, and feature extraction—are performed before data aggregation, which preserves device-level privacy and reduces the computational burden on the IoT gateway. The contemporary CIC-IoT-2023 dataset, which captures a wide range of smart-city protocols and attack vectors, is used to evaluate the architecture. The Edge AI Bridge leads to a significant reduction in detection latency—≈50 ms on average as opposed to the 500 ms of cloud-based solutions—while the resource footprint is kept low to about 20% CPU utilization. The Edge AI Bridge demonstrates a potential solution that is scalable, modular, and can preserve privacy while improving the cyber resilience of the smart-city infrastructures that are large, heterogeneous, and difficult to manage.

1. Introduction

Smart-city infrastructure and its technologies have led to the widespread deployment of IoT devices such as environmental sensors and critical traffic management systems [1]. While these devices enhance urban efficiency through data-driven insights, their inherent constraints in memory and processing power render them vulnerable targets for cyber adversaries [2,3,4]. Traditional security techniques have largely relied on centralized cloud-based intrusion detection systems (IDSs). Nonetheless, Ref. [5] highlights that the large volume of raw data generated at the network edge results in significant bandwidth bottlenecks and unacceptable detection delays for real-time threat mitigation [6].

The most recent studies have already directed their attention to using IDSs that are located at the gateway in order to enhance the security of the data source. Localized ML at the gateway, for example, has been mentioned as having the potential to improve DDoS detection speed [7]. Even with these advancements, the gateway layer in a smart city is often considered a point of failure, as it is sometimes overloaded with tasks such as routing, protocol translation, and data aggregation, which leaves very little room for the execution of complex deep-learning inference in resource-constrained IoT environments [8]. Besides that, the prevailing edge-security frameworks still regard the local network as a trusted zone, thereby inadvertently permitting malware propagation between devices until it reaches the inspection point of the gateway [9].

In order to fill these architectural voids, the present study proposes the Edge AI Bridge, a new micro-computing security layer placed between the IoT device and the gateway. The Edge AI Bridge represents a distinct architectural model based on a Zero-Trust philosophy that operates at the physical entry point of the network. Our architecture utilizes embedded AI hardware for localized behavioral profiling and hybrid threat validation. It is able to stop the malicious traffic at the micro-edge level, thus making sure that it does not reach the core network infrastructure at all.

The focus of this work is to investigate the architectural deployment of intrusion detection at a micro-edge scale rather than algorithm-level optimization of machine learning models. The primary contributions of this work can be categorized into architectural and algorithmic contributions, as summarized below.

Architectural Contributions:

• Micro-layer IDS architecture: We introduce the Edge AI Bridge, a dedicated security micro-layer deployed between IoT devices and the gateway. This placement enables device-level traffic inspection prior to gateway aggregation, allowing earlier interception of malicious flows and reducing the processing burden on the gateway infrastructure.
• Low-latency edge intrusion detection: By performing traffic analysis and machine learning inference directly at the micro-edge, the proposed architecture reduces detection latency to ≈50 ms under the evaluated deployment conditions, compared with typical gateway-based (≈200 ms) and cloud-based (≈500 ms) intrusion detection approaches.
• Bandwidth-efficient alert reporting: The Edge AI Bridge performs local traffic analysis and transmits only structured security alerts rather than raw telemetry streams. This reduces upstream traffic volume and preserves device-level privacy by keeping sensitive data within the edge security layer.

Algorithmic Contributions:

• Hybrid anomaly–signature detection pipeline: We design a lightweight intrusion detection pipeline that integrates unsupervised anomaly detection with signature-based validation. This two-stage mechanism improves detection reliability by identifying previously unseen attacks while filtering benign anomalies.
• Embedded anomaly detection model for IoT traffic: A lightweight autoencoder-based anomaly detection model is implemented for device-level behavioral profiling using compact traffic features extracted from IoT communication flows.
• Improved detection performance on CIC-IoT-2023: Experimental evaluation using the CIC-IoT-2023 dataset demonstrates strong classification performance with a ROC-AUC of 0.972, while maintaining low computational overhead suitable for embedded edge hardware.

The efficacy of the proposed system is validated using the CIC-IoT-2023 dataset, reflecting 33 modern attack categories executed in a real-world IoT topology [10,11]. The Zero-Trust implications of this micro-layer placement are further analyzed in Section 8.

Research Objectives and Threat Model

The primary objective is to create an intrusion detection system that operates with low resource requirements and successfully identifies security threats in smart city Internet of Things networks while maintaining fast response times and showing decreased need for central system support. This research studies whether security intelligence can be moved to IoT devices through the creation of a micro-layer system that monitors network traffic and detects unusual activities while validating security threats before data transmission to the gateway.

The proposed architecture is developed under several practical assumptions that reflect typical smart-city IoT deployments. First, IoT devices are assumed to be resource-constrained and therefore unable to host computationally intensive security mechanisms locally. Secondly, IoT gateways are assumed to perform multiple networking functions such as protocol translation, device management, and data aggregation, limiting their ability to execute continuous AI-driven intrusion detection tasks. Thirdly, the Edge AI Bridge is assumed to operate as a trusted embedded edge component deployed between IoT devices and the gateway.

The threat model considered in this study focuses on network-level attacks targeting IoT communication channels. These include compromised IoT devices generating abnormal traffic patterns, botnet propagation attempts, distributed denial-of-service (DDoS) traffic, scanning behavior, spoofing attempts, and unauthorized command injection. The objective of the proposed Edge AI Bridge is to detect such anomalous communication behaviors at the device–gateway boundary before malicious traffic propagates through the broader smart-city infrastructure.

2. Related Work

Numerous studies have proposed intrusion detection systems to protect IoT environments, particularly in the context of smart city deployments, where large numbers of heterogeneous and resource-constrained devices connect through their distributed network systems. Existing IoT intrusion detection systems can be broadly categorized into three primary architectural and methodological approaches.

• Gateway-based IDS: Intrusion detection mechanisms deployed at IoT gateways where traffic from multiple devices is inspected after aggregation.
• Edge or fog-based IDS: Security analytics deployed on edge servers or fog computing nodes closer to the network edge to reduce latency and improve scalability.
• Behavioral or anomaly-based IoT IDS: Detection approaches that rely on machine learning models to learn normal device communication patterns and identify deviations that may indicate malicious activity.

IoT intrusion detection research has progressed through these approaches; however, each exhibits critical limitations when tested in real-world smart-city environments. Gateway-based systems experience performance problems because gateways handle multiple tasks while edge and fog-based systems process network traffic after their initial data collection. Anomaly detection systems evaluate their performance based on model accuracy, but they do not solve problems related to system deployment. The following subsections discuss representative works in each category and highlight the corresponding limitations.

2.1. Architectural Limitations of Cloud and Gateway IDS

The initial intrusion detection systems developed for IoT environments used centralized cloud-based systems, which required them to send network traffic data to remote servers for processing. The system allowed users to implement powerful machine learning and deep learning models, which detected network attacks through their computational capabilities. The continuous transmission of extensive IoT telemetry data results in cloud-based IDS solutions, causing major communication delays and increased network bandwidth consumption [5,6].

Researchers started shifting intrusion detection systems to the network perimeter because existing systems had operational limitations. The authors of [7] showed that localized machine learning models could detect volumetric attacks such as DDoS in IoT environments when deployed at the gateway. Gateway-based IDSs bring operational difficulties that need to be addressed. The IoT gateways in extensive smart-city implementation work to handle multiple operational functions, which include protocol translation and device management, as well as routing and data aggregation. The attempt to run computer-intensive intrusion detection systems on the gateway results in two problems because it creates processor bottlenecks while decreasing system protection against resource depletion attacks in IoT networks [8].

The proposed Edge AI Bridge architecture design provides a solution to the existing system constraints through its implementation of a dedicated security micro-computing layer, which operates before the gateway. This design enables intrusion detection to be performed through dedicated embedded AI hardware while maintaining all essential networking capabilities of the gateway [12].

2.2. Behavioral Profiling and Anomaly Detection

Behavioral profiling has become an effective method for detecting zero-day attacks together with unknown threats, which target IoT networks [13]. Unlike signature-based systems, anomaly detection approaches operate by learning typical communication patterns of IoT devices, and they use this knowledge to detect any unusual activity that might suggest malicious behavior.

The authors of [9] introduced DIoT, which operates as a federated self-learning intrusion detection system that develops device-type behavioral profiles for detecting IoT traffic anomalies. The DIoT system showed effective results but depended on the gateway for two main functions, which included traffic collection and model training updates. Researchers from [3] studied deep learning-based intrusion detection systems for Internet of Things environments, yet encountered problems with maintaining detection accuracy across diverse smart city systems because of changing device usage patterns and false alarms.

In contrast, the proposed Edge AI Bridge employs a hybrid detection pipeline that combines unsupervised anomaly detection with a lightweight signature validation stage. This two-stage mechanism reduces false positives that often affect single-stage behavioral models while preserving the ability to detect previously unseen attacks.

2.3. Privacy-Preserving Edge Intelligence

Privacy preservation is essential for numerous Internet of Things applications used in smart cities, which include urban surveillance systems, healthcare monitoring solutions, and environmental sensing technologies. The standard intrusion detection systems need to send complete network traffic data and system monitoring information to remote cloud systems for their operational functions. Such methods violate data locality principles because they send data to remote cloud systems, which introduces significant security and data protection challenges in IoT systems [8].

Recent studies have explored privacy-preserving approaches such as Federated Learning (FL), where only model parameters are exchanged between edge devices and centralized servers [10]. Although FL reduces the exposure of raw data, model updates themselves may still be vulnerable to inference attacks if additional protection mechanisms such as differential privacy are not employed. Recent research has also explored secure edge computing frameworks that combine blockchain-based trust mechanisms and reinforcement learning to support reliable and privacy-aware computation at the network edge. For instance, Ref. [14] proposed a blockchain-assisted reinforcement learning framework for secure task offloading in software-defined 5G edge networks, demonstrating how distributed edge intelligence can improve trust management and secure resource coordination in next-generation communication systems.

The architecture proposed in this work extends privacy-preserving edge analytics by performing all traffic inspection and feature extraction locally at the micro-edge. Instead of transmitting raw telemetry, the Edge AI Bridge forwards only compact security alerts containing structured metadata to the gateway. This design supports a privacy-by-design strategy that prevents sensitive device data from leaving the local network environment.

2.4. Resource-Efficient IDS at the Edge

Recent studies have demonstrated that modern smart-city deployments now include various types of cellular Internet of Things devices, which use 5G Reduced Capability (RedCap) devices to achieve their design goals of reducing device complexity while optimizing power usage and network performance in extensive IoT systems [15].

Recent studies have concentrated their efforts on enhancing the computational performance of intrusion detection systems, which operate on devices that have limited processing power. The authors in [16] introduced a lightweight multimodal intrusion detection system, which uses LightGBM and XGBoost models together with Bayesian optimization for its hyperparameter tuning process. The system achieved high detection accuracy with minimal CPU usage when it operated on Raspberry Pi embedded systems.

Although such methods provide strong model-level optimization and energy efficiency, they primarily focus on improving machine learning algorithms rather than addressing architectural deployment challenges. Many of these solutions are tightly coupled to specific hardware platforms or require intrusion detection logic to run directly on IoT devices.

The Edge AI Bridge proposed in this work differs from these approaches by introducing a system-level architectural solution that separates intrusion detection functionality from both IoT devices and traditional gateways. This decoupled micro-layer design enables security inference to be performed on a dedicated embedded node without modifying device firmware or existing gateway infrastructure.

2.5. Research Gap and Motivation

The above discussion shows that current IoT intrusion detection systems have multiple limitations that need to be addressed. Gateway-based IDS solutions operate on aggregated traffic and may experience computational bottlenecks because IoT gateways have multiple operational duties to perform. Edge- and fog-based IDS frameworks reduce detection latency but typically analyze traffic after partial aggregation, which may obscure device-specific behavioral patterns. Behavioral anomaly detection techniques have shown strong success in discovering new attacks that were not previously known; yet, most studies concentrate on enhancing algorithm performance instead of studying their deployment within IoT systems.

These limitations motivate the need for a security architecture capable of performing intrusion detection at the device–gateway boundary before traffic aggregation occurs within the IoT network. The proposed Edge AI Bridge addresses this challenge by introducing a dedicated micro-layer security component positioned between IoT devices and the gateway. This placement enables early traffic inspection, improved device-level behavioral visibility, and reduced computational load on gateway infrastructure.

2.6. Comparative Summary

Table 1. Comparison of IoT Security Architectures.

Feature	Cloud IDS	Gateway IDS	Edge/Fog IDS	Ours (Edge AI Bridge)
Detection Latency	High	Medium	Low	Very Low (<50 ms)
Gateway Load	Low	High	Medium	Negligible
Privacy	Weak	Moderate	Strong	Strong
Zero-Day Detection	Yes	No (Signature)	Yes (Anomaly)	Yes (Hybrid)
Architecture	Centralized	Peripheral	Distributed	Micro-Layered

presents a qualitative architectural comparison synthesized from representative studies discussed in this section.

Table 2. Comparative summary of representative edge-enabled IoT intrusion detection approaches.

Work	Primary Focus	Deployment Location	Detection Approach	Key Characteristics and Limitations
[16]	Lightweight multimodal IDS for edge-enabled IoT	On-device edge node (Raspberry Pi)	Ensemble learning (LGBM + XGBoost) with feature selection	Strong model-level optimization and energy efficiency; IDS tightly coupled to edge device, limited architectural flexibility for large-scale smart-city deployments
[17]	Security challenges in IoT ecosystems	Cloud/Network layer	Survey of IoT security mechanisms	Conceptual overview; does not address IDS deployment or edge constraints
[18]	Cloud-centric IoT security architectures	Centralized cloud	Rule-based and ML-based IDS	High latency and bandwidth overhead; limited suitability for real-time smart-city scenarios
[19]	Fog and edge computing paradigms	Fog/Edge nodes	Architectural framework	Focuses on computation placement; IDS functionality not explicitly addressed
[7]	Behavior-based IoT attack detection	Gateway/Edge	ML-based anomaly detection	Limited to specific attack types; does not consider architectural integration
[20]	Botnet detection in IoT networks	Network edge	Deep autoencoder-based IDS	High detection accuracy; requires extensive training and centralized data collection
This Work	Edge AI Bridge for smart-city IoT intrusion detection	Between IoT devices and gateway	Hybrid anomaly- and signature-based IDS	Decoupled micro-layer architecture enabling early traffic inspection, gateway offloading, privacy preservation, and incremental deployment across heterogeneous smart-city infrastructures

presents the comparison between various intrusion detection techniques that not only concern the IoT but also the edge computing environments. It takes into account the differences in the location of the system, the strategy of detection, and the architectural focus.

From an architectural standpoint, existing IoT intrusion detection systems can be broadly categorized into four classes, which provide the baseline for positioning the proposed Edge AI Bridge. The classes are as follows:

• Centralized cloud-based IDS, where traffic is analyzed remotely;
• Gateway-centric IDS, which performs inspection after traffic aggregation;
• On-device embedded IDS, where detection logic executes directly on IoT endpoints;
• Micro-layer IDS, as proposed in this work, which intercepts traffic at a dedicated security layer positioned between devices and gateways.

This taxonomy clarifies that the Edge AI Bridge occupies a distinct architectural boundary, motivating its design as a micro-layer intrusion detection architecture, combining early interception with deployment feasibility in heterogeneous smart-city environments.

2.7. Architectural Distinction from Edge- and Fog-Based IDS

Although several intrusion detection systems have been proposed for edge or fog computing environments, most existing solutions place the detection logic either within IoT gateways, fog nodes, or edge servers. In such architectures, traffic from multiple IoT devices is typically aggregated before security analysis is performed. As a result, device-specific behavioral visibility may be reduced, and the gateway or edge node may experience increased computational load.

The proposed Edge AI Bridge differs from these approaches by introducing a dedicated micro-layer security component positioned directly between IoT devices and the IoT gateway. Unlike conventional edge or fog IDS deployments, which operate at higher network layers, the Edge AI Bridge performs traffic inspection at the device–gateway boundary before traffic aggregation occurs. This architectural placement enables earlier threat interception, device-level behavioral profiling, and reduced processing overhead on gateway infrastructure.

Furthermore, the Edge AI Bridge is designed as a modular security node that can be incrementally deployed without modifying existing IoT devices or gateway firmware. This distinguishes the architecture from device-embedded IDS approaches that require security logic to be executed directly on constrained IoT endpoints. The micro-layer design, therefore, combines early traffic inspection with practical deployment feasibility in heterogeneous smart-city environments.

Table 3. Architectural comparison of IDS deployment models in IoT environments.

Architecture Type	Deployment Location	Processing Flow	Security Coverage
Cloud-based IDS	Centralized cloud infrastructure	Traffic transmitted from IoT network to cloud for analysis	Global network visibility, but high latency and bandwidth overhead
Gateway-based IDS	IoT gateway or edge router	Aggregated device traffic inspected at gateway	Limited device-level visibility and increased gateway workload
Edge/Fog-based IDS	Edge servers or fog nodes	Traffic analyzed after partial aggregation at edge computing nodes	Lower latency than cloud but still operates on aggregated traffic flows
On-device IDS	Directly on IoT devices	Security analytics executed locally on each device	High visibility but limited by device resource constraints
Edge AI Bridge (Proposed)	Micro-layer between IoT devices and gateway	Device-level traffic inspected before aggregation using embedded AI	Early threat interception, device-specific profiling, reduced gateway load

 summarizes the architectural differences between conventional IDS deployment models and the proposed Edge AI Bridge, highlighting distinctions in deployment location, processing flow, and security coverage.

The proposed Edge AI Bridge architectural design introduces its core security defense system through an explicit security micro-layer, which operates at the boundary between devices and gateways. The micro-layer method treats the device–gateway interface as a security enforcement point that protects the system, in contrast to standard edge or fog-based IDS designs, which use computing nodes for traffic monitoring after traffic aggregation. The system enables monitoring of device activities at the device level before multiple devices combine their data into aggregated network flows, which allows for quicker detection of threats and better identification of unusual system behavior.

Most current edge and fog-based IDSs examine network traffic through upper network layers, which already combine information from different devices. The process of aggregation creates two problems because it produces a loss of detailed behavior information, and it makes it harder to identify harmful activities that start from particular IoT devices. The Edge AI Bridge system achieves two functions through its operation because it interrupts network traffic at its most basic level before any data passes through gateway systems, and the system maintains full access to device-level telemetry data while decreasing the load on gateway resources.

3. System Overview

The infrastructure of smart cities is increasingly reliant on a wide variety of IoT devices for different functions like monitoring, control, and automation in areas like transportation, environmental, energy, and security. These devices are often designed with limited resources and poor security features, which makes them prone to interference, impersonation, and malware propagation. Previous studies like  [21,22] have pointed out that such limitations are the root cause of vulnerabilities when the lowest tier of a city’s digital ecosystem is formed by IoT devices.

A conventional IoT security architecture typically assigns a large portion of the detection tasks either to a central cloud server or to the IoT gateway. The intrusion detection systems operated in the cloud gain access to sophisticated analysis and worldwide visibility, but at the same time, add communication delays and require more bandwidth. Furthermore, the process of sending unprocessed telemetry data to the cloud not only increases the risk of privacy violations but also makes the adversaries’ targets more appealing, as mentioned in [18]. On the other hand, the monitoring performed at the gateway gives access to the device’s traffic but is constrained by the efforts of the gateway, which typically performs multiple tasks such as protocol negotiation, managing addresses, scheduling, and aggregating data. Literature such as [23] argues that these conflicting needs cut down the possibility of dealing with continuous, AI-driven threat analytics at the gateway level.

The proposed design introduces a distinct and lightweight processing unit called the Edge AI Bridge that would link device vulnerabilities and gateway limitations. The bridge acts as a mediator that is deliberately placed between IoT devices and the gateway, thus acting as the first detection point for any malicious or abnormal behavior. This concept supports the prevailing trend of distribution and nearness-source security schemes as indicated in [19], which emphasizes the need for short decision latencies and less reliance on core networks.

The Edge AI Bridge is constantly monitoring the data flow from all IoT devices that are connected to it. The bridge forwards raw packets to the gateway while also performing local inspection via protocol parsing, feature extraction, and flow-level behavior analysis. The AI processor embedded in the system permits the running of very simple anomaly detection models that mark the abnormal behavior of each device with respect to the communication patterns. This feature is a further development of the previous works on behavior profiling, such as [24], but at the same time, it introduces an even more detailed placement of the analytics that takes place before the data aggregation and routing at the gateway happens.

Figure 1 shows the overall architecture of the system. The picture illustrates the flow of the telemetry data from IoT devices to Edge AI Bridge, where the processes of traffic monitoring, anomaly detection, and threat validation take place before the alert is sent to the gateway. This diagram emphasizes the communication and security processing separation, which was the reason for the inclusion of a dedicated micro-layer security entity in the smart-city network stack.

Illustrative Smart-City Deployment Scenario

To illustrate how the proposed architecture can be integrated into practical infrastructure, consider a representative smart-city traffic monitoring system deployed at a major urban intersection, as shown in Figure 2. Such systems typically consist of multiple IoT devices, including traffic cameras, environmental sensors, vehicle-count detectors, and adaptive traffic signal controllers. These devices continuously generate telemetry and event-driven traffic streams that are typically forwarded to a nearby IoT gateway for aggregation and transmission to municipal control centers.

In the proposed architecture, as illustrated in Figure 2, the Edge AI Bridge is deployed as a dedicated micro-layer security node between the IoT devices and the gateway, enabling early traffic inspection and anomaly detection before data aggregation occurs at the gateway. Physically, the Edge AI Bridge can be installed within the same roadside cabinet or edge computing enclosure that houses the gateway hardware commonly used in smart-city infrastructure. All device communication flows through the bridge before reaching the gateway, allowing the system to perform packet capture, traffic profiling, and anomaly detection at the device–gateway boundary.

During normal operation, the Edge AI Bridge forwards device traffic to the gateway without modification. When anomalous behavior or malicious communication patterns are detected—such as abnormal traffic bursts from compromised sensors or unauthorized control messages targeting traffic signal controllers—the bridge generates structured security alerts. These alerts are transmitted to the gateway and can subsequently be forwarded to higher-level monitoring systems such as municipal security platforms or Security Information and Event Management (SIEM) systems.

This deployment model enables early threat interception while maintaining compatibility with existing IoT gateway infrastructure. Because the Edge AI Bridge operates as an independent micro-layer component, it can be incrementally deployed in critical smart-city environments such as traffic monitoring networks, public surveillance systems, or smart grid substations without requiring modifications to existing IoT devices or gateway firmware.

4. Proposed Architecture: The Edge AI Bridge

The proposed framework introduces the Edge AI Bridge as a specific micro-layer security module that is placed in between IoT devices and the IoT gateway. The design of the Edge AI Bridge allows the interception of threats at the very beginning by performing lightweight analytics and machine learning inference along the communication path from the device to the gateway. The Edge AI Bridge, unlike the traditional IDS installations that run at the cloud or gateway levels, offers device-specific inspection in real-time with no considerable computational load on the upstream infrastructure. This design aligns with the tendency of decentralized and latency-aware security processing, which has been pointed out in [19].

4.1. Architecture Overview

The modular structure of the Edge AI Bridge is illustrated in Figure 3. Inbound data coming from IoT devices is processed by a series of components that carry out monitoring, feature extraction, anomaly detection, and threat validation. These components operate locally within the Edge AI Bridge and perform on-device inference. The bridge functions as a security gateway that protects the system by detecting any untrusted or atypical data before it reaches the gateway. The micro-layer technology enables the architectural design to reveal complete electronic device capabilities, which normally become hidden during the process of merging data at higher network layers. The research on device profiling methods receives a new development through this technique, which brings behavioral analytics closer to the data source.

In the suggested structure, the Edge AI Bridge acts as a pivotal middle layer for immediate intrusion detection in IoT smart city ecosystems. Figure 3 shows the elaborate data flow pipeline, which incorporates localized AI processing to boost security and privacy, all the while reducing latency and overhead.

4.2. Traffic Monitoring and Pre-Processing

The Traffic Monitoring Module is the principal operational unit of the Edge AI Bridge that becomes activated and exercises control over the data and/or telemetry streams from IoT devices. It executes protocol-aware decoding and classifies the streams according to message frequency, payload size variation, timing intervals, and device-specific metadata. These lightweight operations have a negligible effect on the overall system latency, and the data is prepared for the next analytics step. The local traffic pre-processing feature is consistent with the privacy-preserving principles mentioned in the literature on analytics, as there is no requirement to transmit raw telemetry beyond the bridge.

In practical wireless IoT deployments, packet buffering behavior and wireless channel contention may influence the rate at which traffic is captured and processed at the micro-edge. For example, channel access strategies and buffering mechanisms in shared wireless spectrum can affect packet acceptance probability and delay characteristics under congested conditions. Analytical studies in [25] have shown that buffering dynamics and medium access contention can significantly impact traffic throughput and packet scheduling efficiency in heterogeneous wireless environments. In the context of the proposed Edge AI Bridge architecture, packet capture and feature extraction operate on short sliding windows and lightweight flow buffers, which limits the buffering delay introduced by local processing. Nevertheless, under highly congested wireless conditions, packet arrival bursts may temporarily increase buffer occupancy before anomaly detection is executed. Future work may explore integrating analytical queueing models or adaptive buffering strategies to further optimize traffic handling performance in dense smart-city IoT deployments.

The Edge AI Bridge maintains lightweight buffering to avoid additional processing delays. The local packet buffer size, together with the feature extraction window duration, establishes the detection responsiveness boundary that operators need to maintain computational stability. Faster anomaly detection with reduced detection latency occurs because smaller buffers, together with shorter sliding windows, allow more frequent extraction and evaluation of traffic features. The use of extremely small buffers results in higher processing overhead because the anomaly detection model requires more frequent inference executions. Short-term traffic fluctuations are smoothed through larger buffers, which work with extended feature extraction windows. However, these extended windows create new delays that start after the initial anomaly detection process.

Traffic bursts resulting from compromised IoT devices or synchronized device operations lead to temporary increases in buffer capacity at the micro-layer. The Edge AI Bridge handles incoming packet processing through its two established methods, which use restricted flow windows and basic feature extraction to handle processing needs that depend on actual flow counts rather than total packet volume. The system design allows for consistent inference latency because it can handle sudden increases in system activity.

This system employs controlled buffering using fixed-size sliding windows to process both packet capture and feature aggregation. The system uses flow-level packet prioritization to handle extreme traffic bursts when buffer capacity reaches its maximum limit because this method enables the system to detect anomalies while avoiding excessive growth of its queues. The detection model uses aggregated flow features for its operations, which enables the system to maintain effective anomaly detection even when packet drops or sampling reductions occur during overload situations. The Edge AI Bridge system operates continuously because it uses this method to prevent buffer overflow problems that arise in smart-city systems with extensive coverage.

4.3. Feature Extraction and Behavioral Analysis

The packet attributes that are extracted are transformed into compact feature representations, which are thus suitable for on-device inference. The Feature Extraction Module utilizes sliding windows, statistical summarization, and timing-sequence modeling to process raw telemetry into behavioral descriptors. These descriptors are given to the Local AI Inference Engine, where lightweight anomaly detection models are placed. The engine utilizes techniques like autoencoder-based reconstruction, temporal deviation detection, and clustering-driven outlier identification—methods influenced by the anomaly detection research, such as that in [20].

The Edge AI Bridge performs inference at the packet-flow level, thus allowing immediate anomaly detection, unlike ML systems hosted in the cloud or on a gateway. By this approach, heterogeneous IoT ecosystems are facilitated since it is possible to define separate baseline profiles for each type of device.

4.4. Threat Signature Matching Pipeline

To reduce the false positives, the Signature Matching Module verifies the anomalies recognized by the inference engine. This module keeps a very small collection of lightweight signatures that are selected very carefully and represent all the major IoT attacks, such as spoofing, scanning, unauthorized command injection, and botnet-related traffic. It is through this secondary stage that the verification of anomalies takes place, and so the architecture is such that only validated or high-confidence alerts are allowed to go upward. This combined detection method utilizes the strengths of both behavioral and signature-based IDS models while keeping the processing complexity to a minimum. Formally, let $\mathbf{x}\in {\mathbb{R}}^d$ denote the extracted feature vector corresponding to a device-level traffic flow, and let $\widehat{\mathbf{x}}$ be its reconstruction produced by the trained anomaly detection model. The anomaly score $A\left(\mathbf{x}\right)$ is defined as the reconstruction error:

$$A\left(\mathbf{x}\right)={∥\mathbf{x}-\widehat{\mathbf{x}}∥}_2^2.$$

(1)

A traffic flow is classified as anomalous if $A\left(\mathbf{x}\right)>\tau$, where $\tau$ denotes a decision threshold determined empirically using the distribution of reconstruction errors observed on normal validation traffic. In this work, $\tau$ is selected as the 95th percentile of anomaly scores computed over benign traffic samples, ensuring sensitivity to abnormal behavior while limiting false positives. The anomaly score threshold $\tau$ defined above is used as the decision criterion in the operational pipeline summarized in Algorithm 1.

Algorithm 1 Hybrid Intrusion Detection Pipeline of the Edge AI Bridge.

Require:  IoT traffic stream T, trained anomaly model M, signature set S, anomaly threshold $\tau$ Ensure:  Structured security alerts forwarded to gateway   1: while traffic stream T is active do   2:      Capture packets from IoT device   3:      Aggregate packets into flow window f   4:      Perform protocol parsing and feature extraction on f   5:      Compute anomaly score $A\left(f\right)$ using model M   6:      if $A\left(f\right)>\tau$ then   7:           Perform lightweight signature matching using S   8:           if signature match found then   9:                 Generate validated security alert a 10:           else 11:                 Generate anomaly-based alert a 12:           end if 13:           Structure alert metadata and forward a to IoT gateway 14:      else 15:           Forward flow f to gateway without modification 16:      end if 17: end while

4.5. Alert Generation and Gateway Interaction

Whenever the Alert Generation Module confirms a match with either an anomaly or a threat, it triggers the creation of a structured security event that contains metadata like device identifier, timestamp, rule identifier, anomaly score, and threat classification. The communication between the bridge and the IoT gateway is not performed through raw packets but rather through very short alert summaries sent via a secure and authenticated channel. Consequently, less bandwidth is consumed, gateway management is less complicated, and device privacy is preserved.

A key aspect of the system is privacy preservation: all the operations are carried out locally on the edge device, and the raw data is never transmitted out of the bridge. This configuration reduces response time in comparison to cloud-based systems but also complies with Zero-Trust principles by applying microsegmentation at the device level. The modular pipeline outlined in our work resolves the limitations of conventional IDS architectures, as highlighted in Section 2, and allows for scalable deployment in diverse smart-city networks. Section 10 presents the results of the experimental evaluations that show its effectiveness in recognizing security threats with a low rate of false positives and at the same time being resource-efficient. The gateway, no longer tasked with constant monitoring, now has the option of sending combined alerts to advanced edge analytics systems, SIEMs, or cloud-based threat intelligence modules.

Algorithm 1 formalizes the data flow illustrated in Figure 3, mapping each procedural step to a functional block within the micro-layer architecture.

4.6. Modular Deployment and Scalability

The modularity and scalability of the deployment model are among the primary architectural advantages. Different areas of the smart-city network, such as residential areas, public places, intersections, utility areas, or even within the utility grids, can host the Edge AI Bridges. The independent working of each bridge ensures that the first stage consists of localized threat detection, followed by containment before any further spreading occurs. A decentralized construction of this kind can readily accommodate thousands of distributed IoT devices without experiencing the slowdowns that are typical of the gateway-based or centralized detection techniques. The method is in agreement with the concept of bringing security functions nearer to data in edge-computing ecosystems that has been referenced in [21].

4.7. Design Rationale

The Edge AI Bridge implements specific architectural decisions to address constraints that are common across various executions of IoT systems:

• Latency Reduction: Early processing can eliminate the dependency on round-tripping with a cloud.
• Gateway Relief: Security analytics are offloaded from gateways, preventing overload.
• Fine-Grained Visibility: Device-specific inspection identifies subtle anomalies earlier.
• Privacy Preservation: Raw data remains local; only alerts are transmitted.
• Scalability: Distributed micro-layer design supports large-scale smart-city deployments.

Collectively, these characteristics differentiate the Edge AI Bridge from existing IDS frameworks and motivate its introduction as a distinct architectural element within smart-city IoT security systems.

4.8. End-to-End Detection Workflow

The overall operational workflow of the proposed Edge AI Bridge can be summarized as a sequence of processing stages starting from IoT device communication and ending with security alert generation. Figure 3 illustrates the system-level data flow, while Algorithm 1 provides a procedural description of the hybrid detection process implemented within the Edge AI Bridge.

The end-to-end operation proceeds as follows:

• IoT Traffic Generation: IoT devices such as environmental sensors, smart lighting systems, surveillance cameras, and traffic monitoring units generate periodic or event-driven network traffic within the smart-city infrastructure.
• Traffic Interception at the Micro-Layer: Instead of forwarding traffic directly to the gateway, communication streams are first intercepted by the Edge AI Bridge, which is positioned between IoT devices and the gateway.
• Packet Capture and Flow Aggregation: The traffic monitoring module captures incoming packets and aggregates them into short flow windows for lightweight analysis. Protocol parsing and basic metadata extraction are performed at this stage.
• Feature Extraction: The captured packet streams are transformed into compact feature vectors using statistical and temporal descriptors such as packet inter-arrival time, message size variance, and communication frequency.
• Anomaly Detection: The extracted features are passed to the embedded anomaly detection model, which evaluates deviations from learned normal device behavior using reconstruction error scoring.
• Signature Validation: If the anomaly score exceeds the predefined threshold, a lightweight signature-matching stage validates the traffic pattern against known IoT attack signatures in order to reduce false positives.
• Alert Generation: When a threat or anomalous behavior is confirmed, the system generates a structured security alert containing device identifier, timestamp, anomaly score, and threat classification.
• Gateway Notification: Only the summarized security alerts are forwarded to the IoT gateway through a secure communication interface, while raw telemetry data remains locally processed at the Edge AI Bridge.

This workflow enables early intrusion detection at the device–gateway boundary while minimizing processing overhead on gateway infrastructure and preserving device-level privacy.

5. Novelty of the Architecture

The proposed Edge AI Bridge introduces several architectural features that differentiate it from existing intrusion detection systems in IoT and edge computing. Existing architectures typically place security mechanisms either in the cloud or at the gateway level [18,23]. Conversely, the Edge AI Bridge creates a separate micro-layer security element that can cut through and assess IoT traffic prior to its entrance into the upstream infrastructure.

5.1. Dedicated Micro-Layer Security Placement

One of the main innovations is the addition of a special processing layer that sits between IoT devices and the gateway. Current edge-based IDS frameworks are typically co-located with gateway hardware or fog nodes; thus, the detection of threats is limited to the areas closest to the gateway. The suggested approach opens up the possibility of inspecting the device traffic before aggregation, which makes it possible to detect certain types of instances right where they are originating instead of after they have passed through routing or protocol translation.

5.2. Hybrid Detection Pipeline on Embedded AI Hardware

The Edge AI Bridge integrates both anomaly-based and signature-based detection methods within a lightweight hybrid pipeline operating on embedded AI hardware. Previous works like [20] have demonstrated the feasibility of ML-based detection, but they are mostly oriented towards cloud or server. The innovation of this study comes from the fact that such models are made to run efficiently on low-power processors, while still being able to respond in real-time.

5.3. Device-Specific Behavioral Profiling

The structure allows individual behavioral baselines to be set for various IoT devices. The current profiling-based intrusion detection system (IDS) methods depend on comprehensive edge servers or cloud solutions for processing. The transfer of behavioral model assessment to the Edge AI Bridge grants the system access to detailed information about the actions of the devices and ensures better accuracy in the detection of anomalies.

5.4. Privacy-Preserving Alert Communication

The Edge AI Bridge, as opposed to cloud-based IDS that necessitate unprocessed telemetry or packet streams for classification, sends only confirmed alerts to the gateway. This method, by nature, restricts the revealing of sensitive device information, which is consistent with established intrusion detection and IoT security principles [8] and also applied to an embedded, real-time security node.

5.5. Scalable, Modular Deployment for Smart-City Environments

The Edge AI Bridge’s modularity makes it possible to use several units in different smart-city clusters that are far apart. This way, the architecture can be more extensive and at the same time limits the amount of data sent to the main servers, which is a major drawback for monolithic systems mentioned in [17]. Consequently, a distributed security mesh is being built that is able to do continuous monitoring in high-density areas.

In summary, the proposed architecture enhances IoT security by integrating optimal placement, processing efficiency, privacy awareness, and scalability into a unified intrusion detection framework tailored for smart-city deployments.

This research establishes its primary design framework through the implementation of security micro-layering as a fundamental design principle, which it presents from an architectural design perspective. The system design introduces a lightweight processing layer that conducts security assessments at essential communication points instead of implementing intrusion detection through direct integration into IoT devices or through increased analytical duties on gateway systems.

The principle applies to all IoT security systems that use specialized micro-layer components to connect resource-limited devices with their higher operational systems. The system achieves three benefits through the deployment of lightweight security intelligence at architectural boundaries, which enables early threat detection, better device behavior monitoring, and decreased need for processing power across central systems. The growing size and diversity of IoT ecosystems make micro-layer security frameworks an effective solution for implementing security analytics near data sources while ensuring compatibility with current network systems.

6. Methodology

The methodological framework for the design, implementation, and evaluation of the proposed Edge AI Bridge is specified in this section. The methodology comprises traffic modeling together with feature extraction, machine learning inference, threat–signature validation, and alert handling, which are all merged into a single IDS pipeline that is best suited for embedded hardware.

6.1. Operational Data Flow

The methodology adheres to the architectural model’s end-to-end data flow, which is represented. Telemetry or packet streams are created by IoT devices, and the Edge AI Bridge captures these streams before they reach the gateway. In accordance with distributed edge analytics [19], the processing is performed as close to the data source to minimize detection latency.

6.2. Dataset Design and Traffic Characterization

During training and evaluation of the anomaly detection models, the device traffic is classified into two behavioral categories: normal and abnormal. Normal traffic represents typical device usage, which consists of communication patterns like sensor updates, request-response cycles, and periodic beacons that the system recognizes. Abnormal traffic indicates various attack scenarios such as botnet-induced flooding, spoofing attempts, unauthorized control messages, or unexpected traffic bursts, which are guided by previous analyses of IoT attacks, e.g., [20].

In scenarios where actual datasets are not accessible, the synthetic device profiles can be created by changing message rates, payload types, and timing intervals, thus simulating common IoT operations. This process allows for a systematic assessment of different device classes. Synthetic device profiles were employed only for scalability and stress-testing experiments. All reported detection accuracy and ROC performance results were derived exclusively from the CIC-IoT-2023 dataset.

6.3. Evaluation Assumptions and IoT Deployment Model

To evaluate the proposed Edge AI Bridge architecture, we assume a representative smart-city IoT deployment consisting of multiple heterogeneous devices generating periodic and event-driven network traffic. Typical device categories include environmental sensors (e.g., air-quality and temperature sensors), smart lighting systems, surveillance cameras, and traffic monitoring devices. These device types reflect common components of urban IoT infrastructures and exhibit diverse communication patterns, ranging from low-rate periodic telemetry to bursty event-triggered transmissions.

The experimental evaluation utilizes the CIC-IoT-2023 dataset, which was specifically designed to represent realistic IoT environments. The dataset includes traffic traces generated from a heterogeneous IoT testbed incorporating multiple device types and communication protocols commonly used in smart-city deployments. In addition to benign traffic patterns such as periodic sensor reporting and control messaging, the dataset contains 33 different attack categories representing contemporary IoT threats.

Table 4. Summary of the CIC-IoT-2023 dataset characteristics used for training and evaluation.

Attribute	Description/Value
Dataset Source	Canadian Institute for Cybersecurity (CIC), UNB
Dataset Name	CIC-IoT-2023
IoT Environment	Smart environment with heterogeneous IoT devices
Number of IoT Device Types	15–20 (cameras, sensors, smart appliances, controllers)
Total Traffic Flows	∼8–10 million flows
Benign Traffic Samples	∼55–60% of total flows
Attack Traffic Samples	∼40–45% of total flows
Attack Categories	DDoS, DoS, Brute Force, Spoofing, Scanning, Botnet-related attacks
Traffic Granularity	Packet-level and flow-level
Feature Types	Statistical, temporal, protocol-based, flow-level
Protocols Covered	TCP, UDP, HTTP, MQTT, CoAP, DNS
Labeling	Binary (Benign/Attack) and multi-class
Train–Test Split	70% training, 30% testing
Usage in This Work	Training and evaluation of Edge AI Bridge IDS

summarizes the main characteristics of the CIC-IoT-2023 dataset used in the experiments, including the IoT device environment, traffic composition, attack categories, supported protocols, and the training–testing data split employed in this study.

The attack scenarios considered include botnet activity, distributed denial-of-service (DDoS) traffic, scanning behavior, spoofing attempts, and unauthorized command injection. These attacks reflect common threat vectors observed in real-world IoT environments where compromised devices are frequently exploited as part of larger botnet infrastructures. While the frequency of such attacks varies depending on deployment conditions, prior studies have reported that compromised IoT devices often generate anomalous bursts of traffic or abnormal communication patterns that can be detected through behavioral profiling.

The evaluation therefore focuses on assessing the ability of the Edge AI Bridge to detect anomalous traffic flows under heterogeneous device behavior while maintaining low processing overhead suitable for embedded edge deployments.

6.4. Feature Extraction Strategy

The Edge AI Bridge extracts lightweight statistical and temporal features suited for embedded computation. These include the following:

• Packet inter-arrival times;
• Message size variance;
• Frequency of control vs. data frames;
• Flow-level entropy metrics;
• Rolling-window behavioral summaries.

This feature set is intentionally compact to support real-time inference while capturing behavioral deviations highlighted in IoT profiling literature such as [24]. The rationale behind selecting these features is based on their ability to capture key behavioral characteristics of IoT communication patterns while remaining computationally efficient for edge deployment.

The selected feature set focuses on lightweight flow-level descriptors that capture temporal and statistical characteristics of IoT communication behavior. Features such as packet inter-arrival time, packet size distribution, entropy-based metrics, and flow-level statistics are commonly used indicators of anomalous network activity in IoT environments. These descriptors allow the model to capture deviations in communication timing, traffic volume, and protocol usage patterns that often occur during botnet activity, scanning behavior, or command injection attacks.

The use of lightweight statistical features is particularly suitable for resource-constrained edge environments, as they can be extracted efficiently without deep packet inspection or high computational overhead. This design choice aligns with the objective of enabling real-time intrusion detection directly at the micro-layer edge node.

Explicit feature selection was not applied in this work, as the selected features were derived from prior studies on IoT traffic behavior and were intentionally kept compact to minimize processing overhead on embedded edge hardware. However, preliminary analysis indicated that the chosen feature set provides sufficient discriminative capability for distinguishing normal IoT communication patterns from anomalous behavior within the CIC-IoT-2023 dataset.

6.5. Model Training and Validation Procedure

The Edge AI Bridge contains an integrated anomaly detection model, which underwent both training and testing procedures by using the CIC-IoT-2023 dataset. The dataset established reliable model evaluation by dividing the data into training and testing sets in the ratio of 70:30. The training subset enabled the system to learn device communication patterns, while the testing subset enabled system evaluation through assessment of new traffic samples. The testing dataset remained completely unavailable during model training, which enabled us to evaluate detection performance without any bias.

All extracted flow-level features, which were obtained from the data, needed to undergo normalization before model training to create a common numerical scale that would match all feature dimensions. The process of feature normalization prevents features with larger numerical ranges from controlling the learning process. The process also enhances the stability of anomaly detection models, which work on heterogeneous Internet of Things traffic patterns.

The anomaly detection model used normalized feature vectors, which were obtained from packet flow statistics that were recorded at the Edge AI Bridge. The model assessment process used standard intrusion detection metrics, which included detection accuracy, true positive rate, false positive rate, and Receiver Operating Characteristic (ROC) analysis. The model evaluation metrics enable complete evaluation of the system’s capacity to identify legitimate IoT traffic and malicious behavior during actual network operations.

6.6. Machine Learning Inference Engine

The anomaly detection model is implemented using lightweight ML architectures appropriate for embedded inference, such as:

• Autoencoders for reconstruction-based deviation scoring;
• One-class classifiers for normal-traffic boundary modeling;
• Shallow temporal convolutional networks for sequential patterns.

The selection of model type depends on resource constraints and training dataset characteristics. Training is performed offline, while inference executes on the Edge AI Bridge in accordance with embedded AI design patterns.

6.7. Threat Signature Validation

The process of verifying signature sets through established rules will begin after the detection of anomalies. The system will verify that the generated inference notifications correctly link to the Internet of Things (IoT) attack patterns that have been identified. Signature-based intrusion detection system (IDS) methods have been generally used in the case of standard networks. The smart-city IoT environment has discovered a new method for using embedded micro-layers through its exploration of signature-based intrusion detection system (IDS) methods.

6.8. Alert Generation and Reporting

Once an anomaly is confirmed, the system generates a structured alert containing metadata such as:

• Device identifier;
• Anomaly score;
• Signature ID (if applicable);
• Timestamp and affected protocol.

In alignment with privacy-preserving design principles, only summarized alerts—not raw telemetry—are forwarded to the gateway.

6.9. Evaluation Metrics

To evaluate system performance, the following metrics are considered:

• Detection latency: Time from packet capture to alert emission;
• Inference overhead: Model execution time on the embedded processor;
• False positive/false negative rates: Reflecting detection reliability;
• Resource utilization: CPU, memory, and power consumption profiles;
• Bandwidth reduction: Percentage of upstream traffic eliminated.

These metrics collectively demonstrate the viability of the Edge AI Bridge for real-time, distributed IDS deployment in large-scale smart-city environments.

7. Hardware Platform and Model Architecture

This section describes two main components, which include the selection of hardware platforms for Edge AI Bridge deployment and the development of machine learning models that will detect intrusions. The selection process requires real-time processing capabilities together with low power requirements, and the technology must operate successfully in smart cities, which have limited budgets and energy constraints.

7.1. Hardware Platform for the Edge AI Bridge

The Edge AI Bridge is designed to operate on an embedded edge computing platform that consumes little power, lying in between IoT devices and the gateway. The hardware platform is defined to have a moderate level of computational power, small memory, and to process packets in real-time. These kinds of limitations are characteristic of the gradual deployment scenarios in smart-city infrastructures, where security applications need to be running all the time, but at the same time, they should not impose a lot of energy and maintenance costs.

The platform includes a multi-core processor integrated with an SoC (System-on-Chip) and built-in support for hardware acceleration, where it is accessible. Network interfaces are set up to enable the inline inspection of device-to-gateway traffic while still allowing the normal communication flows to continue undisturbed. Local memory is enough to accommodate the lightweight machine learning models, feature buffers, and a compact threat signature database.

The Edge AI Bridge is not dependent on any high-end hardware accelerators like GPUs. Rather, it uses optimized CPU-based inference and, if necessary, fixed-point arithmetic, which guarantees that it will work on commonly used embedded platforms. This decision regarding the design enhances the portability and makes it possible to have the heterogeneous smart-city segments deploy the system. From an architectural standpoint, the hardware platform supports the following:

• Continuous packet capture and flow monitoring;
• Real-time feature extraction;
• Low-latency inference execution;
• Secure communication with the IoT gateway.

By separating security analytics from the gateway, the platform conserves gateway resources for primary networking functions while enabling distributed intrusion detection at the micro-layer.

7.2. Reference Edge AI Platform

In the architectural illustration, the VEGA platform is shown as a representative embedded edge AI system used to instantiate the proposed Edge AI Bridge [26]. VEGA provides the necessary computational capabilities for real-time traffic monitoring and lightweight machine learning inference in resource-constrained environments. It is important to note that the proposed architecture is platform-agnostic and does not rely on VEGA-specific features. Any comparable embedded edge AI platform with networking and inference support can be used to deploy the Edge AI Bridge. All performance and resource utilization experiments reported in Section 9 were conducted using deployment configurations representative of the described embedded edge AI hardware.

7.3. Model Architecture Overview

The artificial intelligence model that has been placed on Edge AI Bridge is made so that it can have good detection accuracy at the same time as being efficient on the computational side. Considering the different behaviors of IoT devices and the constant change in network-based attacks, the model is anomaly detection-based rather than just relying on signature-based classification.

7.4. Model Configuration and Reproducibility

To ensure the reproducibility of the results on the VEGA hardware platform, the Deep Autoencoder (DAE) utilized for anomaly detection was configured with a symmetric bottleneck architecture. The specific hyperparameters are detailed in

Table 5. Hyperparameter configuration for the Edge AI Bridge DAE.

Parameter	Value
Layer Architecture	Input (48) → Dense (32) → Latent (8) → Output (48)
Activation Function	ReLU (Hidden), Sigmoid (Output)
Optimizer	Adam (${\beta }_1=0.9,{\beta }_2=0.999$)
Learning Rate ($\eta$)	$0.001$
Batch Size	128
Epochs	100 (with Early Stopping, patience = 10)
Threshold Logic ($\tau$)	${\mu }_{MSE}+3{\sigma }_{MSE}$

.

The anomaly threshold $\tau$ is derived using the reconstruction error distribution of the benign validation set. We define $\tau ={\mu }_{ϵ}+3{\sigma }_{ϵ}$, where ${\mu }_{ϵ}$ and ${\sigma }_{ϵ}$ represent the mean and standard deviation of the MSE, respectively.

The core model adheres to either an unsupervised or semi-supervised learning paradigm, and it was mainly trained on normal traffic to learn the usual behavior patterns. At the time of inference, the variations from this learned norm are taken as potential invasions. This method is well-suited for IoT ecosystems, where there might be incomplete or no labeled attack data for the new threats.

7.5. Anomaly Detection Model Design

The anomaly detection component employs a lightweight neural architecture optimized for embedded inference. This model operates on flow-level feature vectors derived from packet statistics and temporal characteristics. The architecture consists of the following:

• An input layer corresponding to extracted traffic features;
• One or two hidden layers with a limited number of neurons;
• A bottleneck representation that captures normal behavioral patterns;
• An output layer that reconstructs or scores the input features.

In the case of anomaly detection, reconstruction error or deviation scores are considered as error indicators. This setup occupies less memory and requires less time for inference, but is still able to model the behavior of devices with different characteristics quite well. Depending on the hardware limitations, the architecture can be easily switched to other light models, such as one-class classifiers or shallow temporal networks.

The selection of this lightweight neural architecture was made to create a system that could detect threats while using minimal processing power in embedded edge environments. Initial model parameters, including the number of hidden layers and neuron counts, were chosen based on commonly used configurations in prior IoT intrusion detection studies and were subsequently adjusted through preliminary validation experiments using the CIC-IoT-2023 dataset. During early experimentation, alternative model configurations were also explored; however, deeper neural architectures and more complex ensemble approaches introduced higher computational overhead and increased inference latency. The final configuration was therefore selected as a practical compromise that maintains reliable anomaly detection performance while remaining suitable for real-time execution on the embedded hardware platform used in the Edge AI Bridge.

7.6. Hybrid Detection Pipeline Integration

In order to enhance detection reliability, the anomaly detection model is combined with a rule-based signature validation module. When anomaly scores exceed a predefined threshold, signature matching against known IoT attack patterns is triggered. This hybrid approach minimizes false positives arising from benign but uncommon behavioral changes, such as firmware updates or transitions in operational modes.

The difference that exists between scoring anomalies and signing validation enables independent alterations to every part. The models of machine learning can be retrained from time to time, and the sets of signatures can be updated gradually according to the sources of threat intelligence.

7.7. Model Deployment and Inference Workflow

Model training is performed offline using representative subsets of the CIC-IoT-2023 dataset. Trained model parameters are then deployed to the Edge AI Bridge for inference-only operation. During runtime, the system follows a deterministic inference workflow:

• Capture traffic features over a sliding time window;
• Normalize and encode features;
• Compute anomaly scores using the embedded model;
• Validate anomalies through signature matching;
• Generate structured alerts for the gateway.

This workflow ensures predictable execution time and bounded resource usage, which are the two essential requirements for real-time intrusion detection in smart-city environments. All models were trained and evaluated using subsets of the CIC-IoT-2023 dataset, as described in Section 10.

7.8. Hardware–Model Design Rationale

The combined hardware and model design is a conscious trade-off amongst all three factors, i.e., accuracy, latency, and deployability. The Edge AI Bridge is built to be a lightweight and scalable device by not relying on heavy deep learning architectures and external accelerators. At the same time, the adoption of anomaly-based learning allows the detection of attacks that were never seen before, thus enhancing signature-based methods.

Overall, the proposed hardware platform and model architecture not only comply but also support the core goal of the Edge AI Bridge: providing early, efficient, and privacy-preserving intrusion detection at the periphery of smart-city IoT networks. The modular design allows for gradual deployment with existing gateways without the need for alterations in the core network architecture. The very lightweight feature of the Edge AI Bridge makes it suitable for cost-effective deployment by the use of commercially available embedded platforms.

8. Security and Privacy Analysis

8.1. Security Analysis

The security posture of the Edge AI Bridge was evaluated using the STRIDE methodology. Unlike gateway-centric models, the micro-layer approach intercepts threats at the physical entry point. The above analysis is conducted under the assumption that the Edge AI Bridge operates as a trusted micro-layer security component within the smart-city network.

Table 6. STRIDE Threat Analysis and Micro-layer Mitigations.

Threat	Target	Edge AI Bridge Mitigation
Spoofing	Device Identity	MAC-IP binding and behavioral fingerprinting.
Tampering	Data Integrity	Packet inspection prior to gateway encapsulation.
Repudiation	Admin Actions	Local logging of intercepted malicious payloads.
Information Disclosure	Data Privacy	Local processing; raw telemetry never leaves the bridge.
Denial of Service	Network Availability	Volumetric filtering at the physical port level.
Elevation of Privacy	Control Logic	Signature-matching of known exploit payloads (e.g., Mirai).

summarizes the STRIDE-based threat classification together with the micro-layer mitigation mechanisms provided by the Edge AI Bridge.

8.2. Alignment with Zero Trust Architecture (ZTA)

The Edge AI Bridge fundamentally shifts IoT security from a traditional perimeter-based model to a Zero-Trust framework by treating every device connection as potentially hostile.

• Micro-Segmentation: The Bridge serves as a refined boundary that divides every single IoT device or group of devices, thus creating a secure zone for each one. It does not allow the spreading of a breach, and thus, if one sensor (for instance, a smart streetlight) is hacked, it will not be able to spread unimpeded to the crucial urban facilities like power grids.
• Continuous Monitoring and Validation: In contrast to legacy systems that rely on single authentication, the Bridge constantly validates each packet flow behaviorally. It practically “checks over again” the authenticity of the device in real-time by looking at data patterns and timing sequences.
• Least Privilege Enforcement: The system imposes least-privilege principles by monitoring traffic at the micro-layer, thus permitting only verified and operational-specific data to go through the gateway while blocking unauthorized command injections or scanning attempts.

8.3. Resilience to Common IoT Attack Vectors

• Botnet and DDoS Mitigation: The Bridge shows the origin of botnet-related flooding (e.g., Mirai-like actions). It stops the incoming volumetric attacks from passing through the gateway; thus, it averts the overload of the backhaul links and keeps the service up and running.
• Spoofing and Unauthorized Access: The system identifies MAC/IP spoofing attempts through hybrid detection, which involves matching anomalies with recognized threat signatures. An example of such a spoofing attack is an attacker impersonating a legitimate device.
• Zero-Day Attack Resilience: The unsupervised anomaly detection unit (autoencoder-based) detects features that differ from the normal “benign” baselines, so that the system is capable of signaling new or zero-day exploits which are still without signatures.

8.4. Privacy Preservation by Design

Consistent with GDPR and modern smart-city regulations, the architecture emphasizes Privacy-Preserving Edge Analytics.

• Local Processing Boundary: The raw telemetry data, which possibly consists of confidential biometric or environmental data, is never sent outside the Edge AI Bridge. On-device processing includes all feature extraction and inference activities.
• Metadata-Only Alerting: The Bridge does not send the raw packet streams but only alerts that are structured—compact summaries with the relevant device IDs and threat classifications. Thus, the risk of sensitive data being compromised either during transfer or at the cloud layer is greatly reduced.
• Zero-Knowledge Principles: In the future, the architecture could be expanded to include the ZKP (Zero-Knowledge Proof) validation method, which would make it possible for the gateway to ascertain the validity of a security event without having to look at the private device telemetry that is underneath.

Although the architecture limits data exposure to metadata-only alerts, it is acknowledged that high-frequency alert patterns could potentially allow adversaries to infer device activity levels. This risk can be mitigated through alert aggregation, rate limiting, or future integration of differential privacy mechanisms.

8.5. Threat Model

The proposed threat model assumes that the Edge AI Bridge is deployed as a trusted and physically protected network component, provisioned using authenticated firmware and secure boot mechanisms. IoT devices connected to the bridge and their network traffic are considered potentially untrusted. Attacks targeting physical compromise of the Edge AI Bridge itself are considered out of scope, consistent with assumptions commonly adopted in edge-based IoT security architectures. The focus of this work is on network- and protocol-level attacks originating from compromised IoT devices prior to gateway aggregation.

Under the above assumptions, the threat model for the Edge AI Bridge follows the STRIDE framework. The system faces spoofing threats, which include device identity impersonation and MAC/IP spoofing attacks. The system uses behavioral profiling together with signature validation to defend against spoofing threats. The system protects against packet manipulation attacks through its protocol-aware anomaly detection system. The system protects against repudiation risks through its structured alert logging system, which records timestamps and device identifiers. The system prevents information disclosure by keeping raw telemetry data within the micro-layer, which restricts access to metadata-only alerts. Denial-of-Service attacks, including botnet-driven flooding, are mitigated through early interception at the micro-layer before gateway aggregation. Elevation of privilege attacks, such as unauthorized command injection, are identified through deviations in device-specific behavioral baselines.

9. Performance Evaluation

The Edge AI Bridge assessment method uses lightweight metrics, which demonstrate actual intrusion detection capabilities needed for smart-city IoT systems. The evaluation process tests system performance through multiple attack types and heterogeneous IoT traffic patterns, which originate from the CIC-IoT-2023 dataset. The system evaluation process tests performance through normal device communication patterns and adversarial IoT traffic streams, which simulate real-world IoT operational scenarios.

9.1. Detection Latency

Local AI inference provides a significant reduction in detection latency compared to cloud-oriented systems. Anomalies detected by edge processing are instantly reported, occurring nearly simultaneously with packet arrival, which supports what was mentioned in [19] about computations near the source. Performance assessments reveal that the Edge AI Bridge supports near real-time processing under the evaluated deployment conditions. Figure 4 indicates that the bridge attains a latency as low as 50 ms, which is attributed to localized AI inference and small data transmission overhead, whereas cloud-based (500 ms) and gateway-based (200 ms) systems have much higher latencies. These latency measurements were obtained under controlled experimental deployment involving multiple simulated IoT devices and representative smart-city traffic workloads derived from CIC-IoT-2023.

9.2. Resource Utilization

The embedded AI execution has been optimized to operate under limited processor and memory budgets. The feature extraction and anomaly scoring processes are so efficient that they use minimal computational resources, which allows for continuous monitoring even with low-power hardware. The Edge AI Bridge’s compact design results in low computational overhead relative to cloud-based and gateway-centric IDS deployments. Figure 5 illustrates the comparison of CPU and memory consumption, highlighting the efficiency of the bridge (e.g., 20% CPU, 100 MB memory) versus the traditional systems with higher loads, thus making it possible to have large IoT networks that can scale up or down depending on the deployment scenarios.

9.3. Experimental Fairness and Baseline Configuration

To ensure a fair comparison between the proposed Edge AI Bridge and baseline intrusion detection approaches, all models were trained and evaluated under consistent experimental conditions. Specifically, the same dataset (CIC-IoT-2023) was used for both training and evaluation across all methods. The dataset was partitioned using identical training and testing splits in order to ensure that each model was exposed to the same traffic patterns and attack scenarios.

The feature extraction process showed consistent application throughout all tested methods. Both the baseline models and the proposed approach utilized identical flow-level statistical features, which they obtained from the monitored packet traffic. The performance evaluation confirms that the detection method evaluation results demonstrate actual performance differences because feature engineering techniques remain unaltered between the two methods.

Baseline models were configured using recommended hyperparameter settings. These settings were obtained from their reference implementations and prior research literature. Wherever applicable, hyperparameter values were adjusted using standard validation procedures to avoid biased performance comparisons. The research used identical training and evaluation methods throughout to achieve consistent experimental results.

These steps ensure that the reported performance differences reflect the architectural and algorithmic characteristics of the proposed Edge AI Bridge rather than variations in dataset preparation, feature design, or hyperparameter optimization. The primary goal of this research study needs to be understood because it exists to assess architectural advantages that come from moving intrusion detection intelligence to micro-layer edge components instead of developing a new machine learning classification system. The research evaluation tests the proposed Edge AI Bridge architecture against standard deployment methods, which include gateway-based and cloud-based intrusion detection systems, to measure their performance in three areas: latency, responsiveness, and operational efficiency.

Established machine learning algorithms, such as Random Forest, XGBoost, and deep neural models, find extensive application in IoT intrusion detection research, which allows their direct implementation as detection engines within the Edge AI Bridge framework. The primary objective of this research focuses on demonstrating that moving lightweight detection models to device–gateway boundaries results in two benefits, which are faster detection times and decreased infrastructure requirements. Future research will benchmark multiple machine learning models running on the proposed architecture to assess how different model complexities affect detection performance and edge computing capacity.

9.4. Detection Accuracy and ROC Analysis

The detection accuracy of the proposed Edge AI Bridge was evaluated using Receiver Operating Characteristic (ROC) analysis to quantify its ability to discriminate between benign and malicious IoT traffic. ROC curves were generated using true positive rates (TPRs) and false positive rates (FPRs) computed from experimentally obtained results on the CIC-IoT-2023 dataset, encompassing 33 distinct attack categories representative of smart-city IoT environments.

Figure 6 illustrates the binary ROC curves (normal vs. attack) for the proposed hybrid detection pipeline. The system achieves a binary ROC–AUC of 0.972 for normal versus attack traffic, indicating strong separability between benign and malicious flows. This AUC value suggests that early anomaly detection at the micro-layer, combined with signature-based validation, contributes positively to classification performance.

The hybrid detection strategy demonstrates a favorable balance between sensitivity and specificity. While the anomaly detection stage enables the identification of previously unseen or zero-day attack patterns, the subsequent signature-matching stage filters benign but irregular traffic, thereby reducing false positive rates. This behavior is particularly important in smart-city deployments, where periodic bursts, firmware updates, or transient network fluctuations may otherwise trigger spurious alerts.

Unlike cloud-centric or gateway-based IDS solutions that operate on aggregated traffic, the Edge AI Bridge performs inference on device-specific flows prior to aggregation. This placement enhances behavioral distinguishability and contributes directly to the observed ROC performance by minimizing class overlap. Minor reductions in discrimination are observed for low-volume attack classes such as scanning and spoofing, which exhibit similar temporal characteristics; however, these do not significantly impact overall system performance.

While ROC analysis provides a global view of discrimination capability, it does not capture class-wise misclassification behavior. Therefore, a multi-class confusion matrix is presented in Section 10.7 to further analyze detection performance across grouped attack categories and to validate the consistency of ROC-derived metrics with class-level outcomes.

To better quantify the performance improvements achieved by the proposed architecture, we compare the results with representative gateway-based and cloud-based intrusion detection deployments. The Edge AI Bridge achieves an average detection latency of ≈50 ms, compared to about 200 ms for gateway-based IDS and nearly 500 ms for cloud-based approaches. This corresponds to an approximate latency reduction of 75% relative to gateway-level detection and about 90% compared to cloud-based detection pipelines.

In terms of detection capability, the hybrid anomaly–signature pipeline achieves a ROC–AUC of 0.972 on the CIC-IoT-2023 dataset, indicating strong discrimination between benign and malicious traffic flows. The combination of early traffic interception and device-level behavioral profiling enables the architecture to maintain high detection reliability while significantly improving response time compared with conventional centralized detection mechanisms.

While the ROC-AUC metric provides a comprehensive view of the model’s ability to distinguish between benign and malicious traffic flows, additional evaluation perspectives such as class-level detection performance and confusion matrix analysis can further illustrate detection behavior across different attack categories. The CIC-IoT-2023 dataset contains a wide variety of attack types, and preliminary inspection indicates that the hybrid anomaly–signature detection pipeline is capable of capturing deviations across multiple attack classes. However, the primary focus of the present study is to evaluate the architectural advantages of performing intrusion detection at the device–gateway boundary rather than conducting an exhaustive comparison of machine learning models across all attack classes.

Similarly, an ablation analysis of the hybrid detection pipeline could further quantify the relative contribution of the anomaly detection and signature validation stages. In the proposed architecture, the anomaly detection component identifies deviations in device communication patterns, while the signature validation stage helps reduce false positives before alert generation. A more detailed component-level analysis and class-wise performance evaluation will be explored in future work to further investigate detection behavior across heterogeneous IoT attack scenarios.

The experimental results demonstrate two important performance advantages that the Edge AI Bridge design brings to system operation. The micro-layer system deployment approach demonstrates better detection speed performance when compared to traditional IDS locations. The experiments show an average detection latency of 50 ms, which exceeds the typical detection time of 200 ms for gateway detection systems because of traffic handling and extra processing demands. The cloud-based detection systems create network transmission delays and centralized processing delays, which result in total system delays of ≈500 ms. The results show that the system achieves a 75% latency reduction compared to gateway detection systems and a 90 percent latency reduction compared to cloud-based IDSs.

Secondly, the proposed hybrid detection pipeline achieves strong classification performance while maintaining lightweight computational requirements, which enable its operation on embedded edge platforms. The system reaches a ROC–AUC score of 0.972 through testing on the CIC-IoT-2023 dataset, which demonstrates its ability to accurately differentiate between harmless and harmful network traffic across multiple IoT attack types. The Edge AI Bridge system uses early traffic interception together with device-level behavioral profiling to achieve accurate detection results while increasing system responsiveness in smart-city IoT environments.

9.5. Detection Sensitivity and AUC Formalization

While Section 9.4 evaluates binary discrimination performance (normal vs. attack), this section examines the model’s sensitivity under multi-class attack categorization.

The classification performance across varying sensitivity levels is assessed using the Receiver Operating Characteristic (ROC) curve. This curve is generated by sweeping the anomaly threshold $\tau$ across the reconstruction error range $[0,max(ϵ\left)\right]$, capturing the relationship between the True Positive Rate ($TPR$) and False Positive Rate ($FPR$). The Area Under the Curve (AUC) is formally defined as:

$$AUC={\int }_0^{1}TPR\left(FP{R}^{-1}\left(x\right)\right)dx$$

(2)

When extended to a multi-class setting across grouped attack categories, the proposed detection pipeline achieves a macro-averaged AUC of 0.982. This high value indicates strong discrimination between benign and malicious traffic patterns, meeting the reliability requirements of smart-city infrastructures. The elevated macro-AUC further reflects improved separability across aggregated attack classes after distinguishing benign traffic from malicious flows.

9.6. CPU Utilization

The CPU usage ratio is a crucial factor in securing IoT devices in smart cities, where edge and gateway resources are commonly utilized for multiple services. The Edge AI Bridge is the result of a development process that is designed to address the challenge of limited processing power in embedded hardware while still allowing for the continuous monitoring of traffic and the making of instantaneous decisions at the same time.

The relationship between CPU utilization and the number of connected IoT devices is illustrated in Figure 7. Three deployment models are considered: a cloud-based intrusion detection system (IDS), a gateway-based IDS, and the proposed Edge AI Bridge.

In the cloud-based model, most computations are performed on remote servers, resulting in minimal local CPU utilization. However, this approach incurs higher communication overhead and latency. In contrast, the gateway-based IDS exhibits a rapid increase in CPU utilization as the number of connected devices grows. This is because the gateway must handle multiple tasks, including packet processing, protocol translation, and security analysis at a single aggregation point.

The Edge AI Bridge displayed a significantly slower increase in CPU usage when juxtaposed with the gateway-based method. This situation is attributed to its distributed processing technique, whereby local traffic is inspected, and inference is performed segment by segment instead of being pushed to the gateway. Moreover, feature extraction and anomaly scoring are performed with low resource consumption. Thus, the system can operate in real-time even with a larger number of devices. As a result, the Edge AI Bridge exhibits reduced susceptibility to saturation effects commonly observed in gateway-centered IDS deployments.

The results indicate that the proposed architecture achieves a favorable trade-off between computational efficiency and detection capability. The Edge AI Bridge alleviates processing bottlenecks by distributing the security workloads among the micro-layer nodes, thus conserving the resources of the gateway for the core networking functions. This characteristic is very useful in the case of large smart city applications where the number of different devices producing concurrent traffic streams can go up to tens of thousands.

9.7. Bandwidth Reduction

Since only alerts are forwarded, upstream bandwidth consumption is lowered. This reduces load on both gateways and backhaul links, addressing concerns raised in cloud-reliant architectures surveyed in [18].

Large-scale smart-city IoT implementations require efficient bandwidth utilization because of the constant transmission of telemetry data to gateways and upstream infrastructure devices. Centralized or cloud-based analysis of traditional intrusion detection systems frequently involves the transmission of raw packet traces or detailed telemetry streams for inspection purposes, which results in high bandwidth usage and increased load on backhaul.

In Figure 8, the upstream bandwidth use of three different types of intrusion detection systems (IDS) deployment models: cloud-based IDS, gateway-centric IDS, and the proposed Edge AI Bridge is shown. The cloud-based approach has the heaviest bandwidth usage since a large part of the device traffic is sent for remote analysis. The gateway-centric IDS method solves the problem by conducting a local inspection of the traffic, but still sends the summed-up data and metadata upstream for the purpose of storage and correlation.

In contrast, the Edge AI Bridge achieves a substantial reduction in upstream bandwidth usage by performing traffic inspection and anomaly detection at the micro-layer. Instead of forwarding raw telemetry or packet streams, the bridge transmits only compact, structured alerts containing essential metadata such as device identifiers, anomaly scores, and threat classifications. This selective reporting mechanism dramatically lowers the volume of data transmitted beyond the local network segment.

The resulting bandwidth savings provide a major advantage in the new architecture, where security analytics are separated from the continuous data forwarding. The Edge AI Bridge, by local filtering of non-threat traffic and only sending security-related events, alleviates network congestion and makes gateway and backhaul resources more efficient. This feature proves to be very useful in the case of extensive smart-city settings, where the limits imposed by bandwidth and high operational costs can be very heavy.

9.8. Scalability Considerations

The deployment of several Edge AI Bridges over smart-city clusters can create a mesh network for distributed detection. This effectively reduces the bottlenecks, typical in gateway-oriented solutions, and allows for horizontal scaling of thousands of devices.

10. Experimental Results Using the CIC-IoT-2023 Dataset

In this section, the experimental evaluation conducted on the proposed Edge AI Bridge with the CIC-IoT-2023 dataset [10] is outlined. The main goal of these experiments is to determine the practicality and efficiency of the suggested intrusion detection system in real IoT traffic conditions consisting of legitimate user behavior and various attack scenarios.

To improve transparency in the experimental comparison,

Table 7. Baseline model configuration and evaluation settings used for comparison.

Method	Feature Set	Training Data	Configuration Notes
Gateway-based IDS	Flow-level statistical features extracted from CIC-IoT-2023	70% training/30% testing split	Trained using the same dataset and preprocessing pipeline as the proposed model. Detection performed after gateway-level traffic aggregation.
Cloud-based IDS	Flow-level statistical features extracted from CIC-IoT-2023	70% training/30% testing split	Centralized model evaluation using identical feature representations and dataset partitions. Latency includes network transmission delay.
Proposed Edge AI Bridge	Lightweight statistical and temporal flow features	70% training/30% testing split	Hybrid anomaly–signature pipeline executed at the micro-layer with embedded inference.

presents a summary of baseline configurations used in the evaluation, which includes feature sets, dataset partitions, and key training parameters for each approach.

All evaluated approaches were implemented using the same CIC-IoT-2023 dataset partitions and an identical feature extraction pipeline to ensure fair comparison. The models used the same preprocessing procedure to extract both flow-level statistical features and temporal features from the data. The research maintained all three elements of preprocessing, which included data normalization, training–testing splits, and evaluation metrics to prevent bias through different preprocessing methods.

The main distinction between the tested methods arises from their respective system designs, which determine how they implement intrusion detection through three distinct deployment options: cloud-based, gateway-based, and micro-layer-based systems. The study demonstrates that different architectural designs of the system produce performance outcomes that depend entirely on their architectural design choices.

10.1. Comparison with Existing IoT IDS Approaches

The suggested Edge AI Bridge is distinct from the present-day IoT intrusion detection systems, mainly concerning the architecture location and the operational area. The cloud-based IDS of the past heavily depended on the centralized traffic taking place in the area and the analysis, which often resulted in a longer time for detection and also consumed a large amount of bandwidth. Although these methods are based on superior computing resources, they still present limited responsiveness for the latency-sensitive smart city applications.

Gateway-centric IDS models provide closer visibility into device traffic. However, gateways are often already responsible for tasks such as protocol translation, routing, and device management, which increases their computational burden. As mentioned in earlier research, the overload of the gateway can have a negative influence not only on the security monitoring but also on the core network functions.

On the other hand, the Edge AI Bridge brings forth a specific micro-layer security feature that carries out intrusion detection in the middle of the traffic aggregation. This positioning allows for earlier threat interception, more detailed device-level visibility, and less workload on the gateway. Contrary to some currently available edge-based IDS frameworks, which rely on strong fog or edge servers, the suggested design focuses on low-power embedded processors, thus enhancing its applicability in resource-limited settings.

The hybrid detection strategy utilized in this study, as opposed to purely anomaly-based IDS methodologies, significantly minimizes false positives by corroborating suspicious activities with known threat signatures. The trade-off between the adaptability and the reliability of the detection system is of paramount importance in diverse IoT installations, wherein the behavior of devices might greatly differ.

In general, the existing IDS solutions are mainly concerned with either detection accuracy or centralized scalability, while Edge AI Bridge highlights architectural efficiency, early interception, and operational practicality; hence, it is suitable for large-scale smart-city deployments.

To highlight the architectural differences between the proposed Edge AI Bridge and existing IoT intrusion detection systems,

Table 8. Qualitative comparison with existing IoT IDS approaches.

Feature	Cloud IDS	Gateway IDS	Edge AI Bridge
Detection Latency	High	Medium	Low
Bandwidth Usage	High	Medium	Low
Gateway Load	Low	High	Low
Device-Level Visibility	Low	Medium	High
Privacy Preservation	Low	Medium	High
Scalability	High	Medium	High

provides a qualitative comparison of representative IDS approaches based on deployment location, detection strategy, resource requirements, and security coverage.

10.2. Dataset Description

The CIC-IoT-2023 dataset is a comprehensive and up-to-date benchmark for synthetic IoT network traffic in smart environment scenarios. It includes both normal IoT device traffic and a wide range of attack types, such as distributed denial-of-service (DDoS), brute-force, spoofing, scanning, and botnet activities. The dataset captures both packet-level and flow-level features, making it well-suited for evaluating network-based intrusion detection systems in IoT environments.

To conduct this research, a specific portion of the dataset was chosen to mirror the unit-to-gateway communication behaviors that fall within the range of the Edge AI Bridge’s functionality. The characteristics pertaining to the timing behavior, packet size distributions, flow statistics, and protocol usage were extracted to create the illusion of real-time feature availability at the micro-layer.

10.3. Experimental Setup

The deployment of the Edge AI Bridge between IoT devices and the gateway is being simulated by the experimental setup. Local execution of feature extraction and anomaly detection took place, illustrating the limitations of embedded edge hardware. Unlabeled parts of the CIC-IoT-2023 dataset served as the basis for training machine learning models offline, which were then released for inference within the Edge AI Bridge pipeline.

Behavioral baselines for normal traffic were built on a per-device category basis, while the performance of attack detection was evaluated by introducing attack samples. The gateway was set up in such a way that only the structured alerts produced by the Edge AI Bridge were allowed through, thus preventing the raw traffic from being sent upstream during detection.

10.4. Results Based on Evaluation Metrics

Standard intrusion detection metrics, including detection accuracy, precision, recall, F1-score, and false positive rate, were used for performance evaluation. In addition, system-level metrics such as detection latency, CPU utilization, and bandwidth reduction were assessed to evaluate the feasibility of the proposed architecture for real-time deployment in terms of hardware and software resources.

10.5. Ablation Study of the Hybrid Detection Pipeline

An ablation study was conducted to quantify the contribution of each detection stage. Three configurations were evaluated: anomaly detection only, signature matching only, and the proposed hybrid pipeline. Results show that anomaly-only detection achieved higher recall but suffered from elevated false positive rates, while signature-only detection demonstrated low false positives but failed to detect zero-day attacks. The hybrid configuration achieved the best balance, reducing false positives while maintaining high detection accuracy across attack categories.

To justify the dual-stage micro-layer pipeline, we conducted an ablation study comparing the “Anomaly-only,” “Signature-only,” and the proposed “Hybrid” configurations as shown in

Table 9. Ablation Study Results.

Configuration	Accuracy (%)	FPR (%)	Latency (ms)	CPU (%)
Signature-Only	82.4	0.05	12.4	8.2
Anomaly-Only	94.1	4.20	42.1	14.5
Hybrid (Proposed)	98.9	0.45	48.2	19.8

.

10.6. Detection Performance

The findings from the experiments suggest that the Edge AI Bridge is highly effective in recognizing the data traffic types in the CIC-IoT-2023 dataset. The anomaly detection component identified deviations from normal behavior across a wide range of attacks, while the signature validation component reduced false positives by filtering out noise in anomaly alerts.

10.7. Multi-Class Performance (33 Attack Categories)

The proposed architecture was tested against the full spectrum of 33 attacks in the CIC-IoT-2023 dataset. For clarity,

Table 10. Detailed Classification Metrics for the 33 CIC-IoT-2023 Attack Categories.

Attack Class	Prec.	Rec.	F1	Attack Class	Prec.	Rec.	F1
DDoS-ICMP	0.99	0.99	0.99	Mirai-greeth_flood	0.99	0.99	0.99
DDoS-UDP	0.99	0.99	0.99	Mirai-udpplain	0.98	0.99	0.98
DDoS-TCP	0.98	0.98	0.98	Mirai-vseflood	0.99	0.99	0.99
DoS-UDP	0.98	0.99	0.98	Dictionary-Brute	0.94	0.91	0.92
DoS-TCP	0.98	0.98	0.98	Browser-Hijacking	0.92	0.90	0.91
DoS-HTTP	0.97	0.97	0.97	Command-Injection	0.91	0.89	0.90
SQL-Injection	0.91	0.88	0.89	XSS	0.92	0.90	0.91
Vulnerability-Scan	0.95	0.93	0.94	Backdoor-Malware	0.93	0.91	0.92
OS-Scan	0.95	0.94	0.94	Uploading-Attack	0.91	0.88	0.89
Ping-Sweep	0.96	0.95	0.95	Recon-HostDiscovery	0.96	0.94	0.95
MITM-ArpSpoof	0.97	0.96	0.96	Recon-PortScan	0.95	0.94	0.94
DNS-Flood	0.98	0.98	0.98	Recon-OSScan	0.95	0.93	0.94
Mirai-Ackflood	0.99	0.99	0.99	Recon-PingSweep	0.96	0.95	0.95
Mirai-HTTPflood	0.98	0.98	0.98	Web-Cracking	0.90	0.87	0.88
Mirai-Synflood	0.99	0.99	0.99	Benign (Normal)	0.99	0.98	0.99

presents the performance metrics grouped by attack family.

To demonstrate the robustness of the Edge AI Bridge against the full threat landscape, we evaluated the detection performance across all 33 attack categories present in the CIC-IoT-2023 dataset. Table 10 provides the precision, recall, and F1-score for each specific attack, ensuring transparency in detection capabilities for both high-volume (DDoS) and low-frequency (Web-based) threats.

Analysis of Misclassifications: While high-volume volumetric attacks (DDoS/DoS) achieve F1-scores near 0.99, the model exhibits slight degradation in web-based attacks (e.g., SQL-Injection, F1 = 0.89). This is attributed to the high semantic similarity between complex administrative IoT queries and malicious payloads. However, the hybrid pipeline ensures that even if a signature match fails, the anomaly detection engine flags the deviation in request frequency and payload size.

As shown in Table 10, the confusion matrix exhibits strong diagonal dominance, indicating high true positive rates across major attack categories. Volumetric attacks such as DDoS and botnet traffic show minimal cross-class confusion, demonstrating the effectiveness of early anomaly detection at the micro-layer. Limited misclassification is primarily observed between scanning and spoofing categories, which share similar low-volume behavioral characteristics. The hybrid anomaly–signature pipeline significantly reduces false positives when compared to anomaly-only detection, particularly for benign but bursty IoT traffic patterns.

10.8. Resource and Communication Overhead

The Edge AI Bridge’s localized processing approach led to a significant decrease in the amount of communication upstream as opposed to cloud- and gateway-centric IDS deployments. The gateway only received alerts, and hence the amount of data sent upstream was much smaller than the total traffic volume represented by the CIC-IoT-2023 dataset. CPU usage was kept at a level that is still considered acceptable for embedded devices, which is an indication that real-time inference can be implemented without over-consuming system resources.

10.9. Discussion of Results

The experimental findings support the main design concepts of the architecture that have been proposed. The Edge AI Bridge’s unique selling point, which is made possible by the combination of micro-layer light anomaly detection with signature-based validation, is not only efficient intrusion detection but also the gain of bandwidth savings and the reduction in gateway load. Furthermore, the application of a cutting-edge, realistic dataset like CIC-IoT-2023 not only enhances the relevance of the results but also makes them applicable to today’s smart-city installations.

Up to now, the research has only focused on network-level traffic characteristics, but the framework can be redesigned to include other telemetry sources and adaptive learning techniques, which may result in a significant increase in robustness towards detection in dynamic IoT environments.

10.10. Performance Metrics and Detection Accuracy

Accuracy, precision, recall, and F1-score were the metrics used to evaluate the performance of our hybrid detection pipeline. The results in

Table 11. Detection Performance on CIC-IoT-2023 Attack Categories.

Attack Category	Accuracy	Precision	Recall	F1-Score
DDoS/DoS	99.42%	98.90%	99.10%	99.00%
Mirai Botnet	98.85%	97.50%	98.20%	97.85%
Spoofing	97.10%	96.40%	95.80%	96.10%
Brute Force	96.45%	95.20%	94.90%	95.05%
Overall Average	98.24%	97.12%	97.25%	97.18%

indicate that the system has reached a state-of-the-art level of performance in terms of the most common smart-city attack vectors.

10.11. Gateway Offloading Efficiency

The reduction in gateway overhead is, among other things, a very important factor that differentiates our work from the rest. The Edge AI Bridge, by filtering 99% of non-threatening traffic and forwarding only structured alerts, has cut the Gateway’s CPU cycles dealing with security by 76%. This procedure allows the gateway to continue delivering higher quality-of-service (QoS) for the main routing tasks.

10.12. Statistical Significance Analysis

To evaluate the reliability of the detection results, the statistical consistency was monitored by performing several experiments that were based on different random train-test splits of the CIC-IoT-2023 dataset. One of the performance metrics that showed minimal fluctuation across the different trials was detection accuracy and false positive rate, which indicated that the models were consistently stable.

Pairwise testing of the deployment variants was conducted using McNemar’s test, and it showed that the Edge AI Bridge is 0.05 level statistically significantly better than the gateway-centric IDS. The area under the ROC curve (AUC) had a consistently tight confidence interval, which indicates that the detection performance observed is not due to the random sampling effect. The results from the confusion matrix also indicate that the classification of the benign and attack classes was performed in a balanced way, thereby reducing class bias. These results are consistent with earlier work conducted on CIC-IoT datasets under controlled laboratory conditions.

Though model optimization is not the main purpose of this study, these outcomes statistically constitute a high enough degree of confidence to affirm the capability of the suggested Edge AI Bridge in practical IoT traffic situations.

11. Limitations and Future Research

While the proposed Edge AI Bridge demonstrates strong performance across simulated smart-city workloads, the study assumes physical protection of the bridge hardware and evaluates performance primarily under controlled traffic conditions derived from the CIC-IoT-2023 dataset. Although this dataset reflects a diverse set of IoT device behaviors and attack categories, real-world deployments may exhibit additional variability in traffic patterns, device heterogeneity, and wireless channel conditions.

Furthermore, the current architecture assumes that the Edge AI Bridge operates as a trusted micro-layer component within the network infrastructure. In practical deployments, the introduction of dedicated micro-layer devices may also introduce additional considerations related to hardware deployment cost, infrastructure management, and maintenance overhead. The system is designed to operate on lightweight embedded edge platforms. However, it requires careful device placement, monitoring, and lifecycle management planning in smart-city deployments. These considerations are necessary to balance operational costs and security benefits.

Scalability becomes essential when IoT devices experience substantial growth in their connected networks. The Edge AI Bridge needs to handle increased packet traffic because device density has reached a point where it requires more data to process before detecting anomalies and extracting features. The micro-layer design solution helps IoT gateways manage their computational load because it allows edge nodes to share processing tasks, but extremely dense locations need either multiple Edge AI Bridges or hierarchical edge coordination systems to sustain their processing efficiency.

The upcoming research will study adversarial machine learning threats that aim to attack three specific areas: anomaly detection systems, hardware tampering protection, and secure attestation systems, which protect edge nodes. This study will examine two research areas, which include cooperative detection between different Edge AI Bridge nodes and adaptive traffic management solutions that operate during times of high congestion and real-world testing of smart-city IoT systems across different operational environments.

Future research will explore how to combine post-quantum secure device authentication methods with existing eSIM-based provisioning systems developed for consumer Internet of Things ecosystems [27]. The research field needs to study how to provide collaborative intrusion detection across multiple smart city security domains because it needs more research than single-domain intrusion detection systems. The Edge AI Bridges, which operate in various urban systems including traffic management networks, public surveillance systems, environmental monitoring platforms, and smart grid infrastructures, enable secure mechanisms to share anonymized threat intelligence and behavioral indicators between their different operational areas. The distributed micro-layer nodes will work together through this collaborative system to detect coordinated attacks, cross-domain propagation patterns, and large-scale botnet activities that remain hidden in local deployment systems. The research area needs to investigate federated learning techniques and distributed alert correlation and cross-domain security orchestration as it seeks to develop city-wide cooperative cyber defense frameworks based on the proposed architectural system.

From a deployment perspective, several practical operational considerations should also be taken into account when integrating the proposed Edge AI Bridge architecture into real-world smart-city infrastructures. First, hardware placement must ensure that the micro-layer device can intercept device-to-gateway communication flows without introducing additional network complexity. In many smart-city environments, the Edge AI Bridge can be co-located with existing gateway cabinets, roadside communication units, or edge computing enclosures that already host networking equipment.

Secondly, large-scale deployments may require multiple Edge AI Bridge nodes because different network segments and urban zones need to be covered. The system achieves scalability through distributed deployment because each bridge operates traffic monitoring and anomaly detection functions while sending summary alerts to the main monitoring systems. The distributed system design enables the smart-city infrastructure to expand without experiencing processing delays at central points.

And finally, practical deployments must integrate with existing smart-city network management and security monitoring systems. These include Security Information and Event Management (SIEM) platforms and municipal network operation centers. The Edge AI Bridge produces structured security alerts instead of raw telemetry streams, which enables monitoring systems to use these alerts for centralized threat analysis, incident response, and long-term security analytics.

12. Conclusions

The rapid expansion of smart-city IoT ecosystems has outpaced traditional centralized security architectures, leaving a critical gap in real-time threat detection and privacy preservation. This work has proposed the Edge AI Bridge, a novel micro-computing security layer that effectively shifts the “intelligence” of an intrusion detection system (IDS) from the gateway or cloud directly to the network edge.

To the best of our knowledge, this work is among the first to introduce a micro-layer intrusion detection component deployed between IoT devices and the gateway, validated on a contemporary, large-scale dataset such as CIC-IoT-2023. Our findings demonstrate that by intercepting and profiling traffic at the device-to-gateway interface, the Edge AI Bridge significantly reduces detection latency, achieving response times as low as 50 ms—while simultaneously relieving the computational burden on resource-constrained IoT gateways. This corresponds to an approximate latency reduction of about 75% compared with gateway-based intrusion detection deployments and nearly 90% relative to traditional cloud-based detection pipelines. The integration of a hybrid pipeline that merges unsupervised anomaly detection with lightweight signature-matching solves the problem of zero-day vulnerability detection and, at the same time, reduces the number of false alarms. Additionally, the implementation of the architecture’s privacy-by-design principle guarantees that local telemetries stay within the bridge environment, where only the structured security alerts are sent upstream.

By carrying out a thorough assessment with the CIC-IoT-2023 dataset, this work confirms that micro-layer security is not only practicable but also necessary for the cyber-resilience of different urban infrastructures. As smart cities evolve to operate through autonomous and decentralized methods, the Edge AI Bridge becomes a secure, modular, and privacy-preserving city foundation for the future. Future research will investigate joint learning over several Edge AI Bridges to facilitate real-time security updates without the need for central retraining.