Quantized Hybrid Anomaly Detection Networks for Dual Engine Anomalies for Edge Intrusion Detection.

As Internet of Things (IoT) gateways, local network switches, and edge routers increasingly face sophisticated cyber threats, deploying deep learning-driven Network Intrusion Detection Systems (NIDS) directly on resource-constrained perimeter hardware has become a paramount objective. However, conventional 32-bit floating-point (FP32) deep neural networks impose computational and memory overheads that prohibit real-time execution on low-power edge nodes. In this paper, we present a lightweight Quantized Dual-Engine Hybrid Anomaly Detection Network architecture tailored for edge-based network intrusion detection on the NSL-KDD benchmark. The pipeline integrates dense categorical entity embeddings with numerical linear projection, feeding temporal sliding windows of connection records into a Bidirectional Recurrent core paired with a dual-engine detection head: (1) a 4-Head Temporal Self-Attention supervised classifier to identify known exploit families, and (2) an unsupervised sequence reconstruction autoencoder to flag novel zero-day exploits via reconstruction deviation. To overcome extreme class imbalance on severe minority attacks (User-to-Root and Remote-to-Local), we formulate an alpha-balanced multi-class focal loss jointly optimized with sequence reconstruction mean squared error. Crucially, we apply post-training dynamic INT8 quantization specifically targeting recurrent cells and dense projection layers. Our empirical evaluations on the full 22,544 test sequences of the KDDTest+ benchmark reveal that dynamic quantization compresses the model memory footprint by 3.45x (down to 158.6 KB for the hybrid detector, and 3.31x down to 86.6 KB for the BiLSTM baseline) while preserving high diagnostic fidelity. Operating under calibrated decision thresholding (tau = 0.30), the hybrid anomaly detector achieves a peak binary detection accuracy of 86.33% in FP32 and 86.04% in Dynamic INT8 (outperforming standard supervised baselines by over 5.5%), while maintaining 79.07% multi-class accuracy (78.33% in INT8). On commodity single-core CPU execution, the quantized pipeline delivers line-rate throughput exceeding 12,200 to 14,895 network flows per second with sub-millisecond per-flow latency (0.067 to 0.081 ms per flow for B >= 64). This proves that high-accuracy sequence-aware intrusion detection and zero-day anomaly isolation can be miniaturized for real-time edge hardware without requiring dedicated acceleration coprocessors.