💻 computer science

Carbon-Aware Intrusion Detection: A Comparative Study of Supervised and Unsupervised DRL for Sustainable IoT Edge Gateways

This paper proposes and evaluates two novel Deep Reinforcement Learning-based Intrusion Detection Systems, DeepEdgeIDS and AutoDRL-IDS, which integrate carbon-aware multi-objective reward formulations to achieve high detection accuracy and energy efficiency for mitigating DDoS attacks on resource-constrained IoT edge gateways.

Original authors: Saeid Jamshidi, Foutse Khomh, Kawser Wazed Nafi, Amin Nikanjam, Samira Keivanpour, Omar Abdul-Wahab, Martine Bellaiche

Published 2026-05-21

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Saeid Jamshidi, Foutse Khomh, Kawser Wazed Nafi, Amin Nikanjam, Samira Keivanpour, Omar Abdul-Wahab, Martine Bellaiche

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

The Big Picture: Protecting the "Smart City" Without Burning the Planet

Imagine the Internet of Things (IoT) as a massive, bustling city where billions of smart devices (like thermostats, cameras, and sensors) are constantly talking to each other. This city has a security guard at every neighborhood entrance, called an Edge Gateway.

The paper addresses two major problems with these security guards:

They are too rigid: Traditional guards only recognize criminals they have seen before (like a "Wanted" poster). If a criminal shows up wearing a new mask (a "zero-day" attack), the guard misses them.
They are too heavy: The guards are trying to be so smart that they are burning through batteries and creating a huge carbon footprint, which is bad for the environment.

The authors propose two new types of "Super Guards" based on Deep Reinforcement Learning (DRL). Think of DRL as a guard who doesn't just memorize a rulebook but learns by doing and experiencing the world, constantly getting better at spotting trouble.

The Two New Guards: DeepEdgeIDS and AutoDRL-IDS

The paper introduces two different approaches to training these guards.

1. DeepEdgeIDS: The "Intuitive Detective" (Unsupervised)

How it works: Imagine a detective who has never seen a criminal before. Instead of looking at a "Wanted" poster, this detective learns what "normal" traffic looks like by watching the city for a while. They build a mental model of "normal."
The Trick: When something weird happens (like a sudden flood of people running in one direction), the detective doesn't need a label saying "This is a riot." They just know, "Hey, this doesn't fit the pattern!" They flag it immediately.
The Superpower: Because they don't need a pre-written list of crimes, they are incredibly good at catching brand-new, unknown attacks (zero-day threats).
The Cost: To stay this sharp, this detective is constantly re-evaluating the situation, which uses a bit more energy and CPU power.

2. AutoDRL-IDS: The "Veteran Cop" (Supervised)

How it works: This guard is trained on a massive library of past cases where the outcome was already known (labeled data). They are like a veteran cop who has studied thousands of "Wanted" posters and knows exactly what a bank robber looks like.
The Trick: They use a specific memory tool (LSTM) to remember the sequence of events. If they see a pattern that matches a known crime, they act fast.
The Superpower: They are very efficient and stable. Once they know the rules, they don't need to think as hard, so they save energy and run cooler.
The Weakness: If a criminal uses a completely new method that isn't in their library, they might miss it or take longer to figure it out.

The "Carbon-Aware" Twist: The Eco-Friendly Reward System

Usually, security systems only care about one thing: "Did you catch the bad guy?"

This paper adds a new rule to the game. The guards are now rewarded not just for catching criminals, but for how efficiently they do it.

The Scoreboard: Every time the guard makes a decision, they get points for catching the threat, but they lose points if they:
- Take too long (Latency).
- Use too much memory (RAM).
- Burn too much electricity (Energy).
- Create too much carbon pollution.

Think of it like a video game where you get a "Gold Star" for winning, but if you use too many power-ups, you get a "Bronze Star" instead. The system forces the AI to find the smartest, greenest way to stop the attack.

The Results: Who Won the Race?

The researchers tested both guards in a real-world "city" (a physical testbed with real routers and devices) under attack.

1. Catching the Bad Guys (Accuracy):

The Intuitive Detective (DeepEdgeIDS) won. It caught 98% of the attacks, including the tricky new ones. It was faster to react because it didn't have to check a library; it just felt the "wrongness" of the traffic.
The Veteran Cop (AutoDRL-IDS) did well too, catching 94%, but it was slightly slower to adapt to the brand-new tricks.

2. The Energy Bill (Sustainability):

The Veteran Cop (AutoDRL-IDS) was the winner here. Because it relied on its pre-learned rules, it used less electricity and produced less carbon. It was the "green" choice for stable environments.
The Intuitive Detective (DeepEdgeIDS) used more energy. It had to constantly "think" and update its brain in real-time to stay sharp. However, the paper argues this extra energy is worth it for the extra safety it provides against unknown threats.

3. Speed:

DeepEdgeIDS was faster at making decisions (lower latency) because it didn't have to process long sequences of history to make a call. It reacted instantly to the "weirdness."

The Bottom Line

The paper concludes that there is no single "perfect" guard. It depends on what you need:

If you need maximum safety against unknown, evolving threats and can spare a little extra energy, choose DeepEdgeIDS (The Intuitive Detective).
If you need maximum efficiency and your threats are mostly known, choose AutoDRL-IDS (The Veteran Cop).

Both systems prove that we can build smart security for the Internet of Things that is not only effective but also cares about the environment by keeping energy use and carbon emissions in check.

Technical Summary: Carbon-Aware Intrusion Detection for Sustainable IoT Edge Gateways

Problem Statement
The rapid expansion of the Internet of Things (IoT) has intensified cybersecurity challenges, particularly regarding Distributed Denial-of-Service (DDoS) attacks at the network edge. Traditional Intrusion Detection Systems (IDS) face critical limitations: they struggle with zero-day attacks due to reliance on static signatures, often produce high false-positive rates in anomaly-based models, and lack adaptability to dynamic traffic. Furthermore, existing Deep Reinforcement Learning (DRL) approaches for IDS frequently overlook sustainability factors. They fail to account for the energy efficiency and carbon footprint of Deep Learning operations, which is increasingly critical for large-scale, resource-constrained IoT edge gateways. There is a research gap in addressing the dual challenge of adaptability (detecting evolving threats) and sustainability (minimizing environmental impact) simultaneously.

Methodology
The paper proposes two novel DRL-based IDS architectures designed for edge gateways, both incorporating a "carbon-aware" multi-objective reward formulation that jointly optimizes detection performance, latency, memory usage, energy overhead, and estimated carbon emissions.

DeepEdgeIDS (Unsupervised AE-DRL Hybrid):
- Architecture: Integrates an Autoencoder (AE) for unsupervised feature extraction with a Deep Q-Network (DQN) for adaptive mitigation.
- Mechanism: The AE learns compressed representations of benign traffic. Anomalies are detected via reconstruction error ( $A_s$ ). This error, combined with traffic statistics (packet rate, SYN/ACK counts), forms the state vector for the DQN agent.
- Learning Paradigm: Operates in a label-free online setting. It does not require ground-truth labels for real-time policy learning.
- Reward Function: Uses deployment-available feedback signals, including anomaly confidence (derived from reconstruction error) and post-mitigation traffic stabilization, rather than ground-truth metrics like detection rate or false-positive rate.
- Theoretical Basis: Proven to converge via the Bellman contraction property under bounded rewards. Stability is ensured through Lyapunov analysis, guaranteeing asymptotic stability under bounded power and carbon constraints.
AutoDRL-IDS (Supervised LSTM-DRL Model):
- Architecture: Augments the DeepEdgeIDS concept with a Long Short-Term Memory (LSTM) network to capture temporal dependencies in traffic patterns, coupled with a DQN agent.
- Mechanism: Leverages labeled data during offline supervised training to optimize detection policies.
- Learning Paradigm: Bridges offline supervised training with online policy adaptation.
- Reward Function: Incorporates ground-truth-dependent metrics (Detection Rate and False-Positive Rate) during the supervised training phase, alongside the sustainability penalties (energy, carbon, latency).
- Theoretical Basis: Formulated as a constrained stochastic control problem using Lagrangian multipliers to handle energy and memory constraints. Convergence is proven via the Karush-Kuhn-Tucker (KKT) conditions and Robbins-Monro stochastic approximation.

Key Contributions

Dual Paradigm Design: The introduction of two distinct DRL-based IDS solutions: a supervised LSTM-DRL model (AutoDRL-IDS) for accuracy in structured scenarios and an unsupervised AE-DRL hybrid (DeepEdgeIDS) for label-free anomaly detection.
Carbon-Aware Optimization: The explicit integration of carbon emissions and energy consumption as continuous feedback variables within the DRL reward function, enabling sustainability-aware decision-making.
Real-World Validation: Deployment and evaluation of both models on physical edge gateways (Raspberry Pi 4) during live DDoS attacks, providing the first carbon-aware benchmarking of DRL-based IDS at the edge.
Theoretical and Statistical Rigor: Proof of convergence for DeepEdgeIDS via Bellman contraction and Lyapunov stability analysis, complemented by Analysis of Variance (ANOVA) to statistically validate performance differences across multiple metrics.

Experimental Results
The models were evaluated using the Bot-IoT dataset and a physical testbed involving ESP32 devices and Raspberry Pi 4 gateways under various DDoS attack scenarios, including zero-day simulations.

Detection Accuracy: DeepEdgeIDS achieved 98.0% accuracy (offline evaluation) and 97.6% recall, outperforming AutoDRL-IDS, which achieved 94.0% accuracy. DeepEdgeIDS demonstrated superior adaptability to zero-day attacks and transient traffic bursts.
Response Time and Latency: DeepEdgeIDS exhibited lower latency and faster response times (stabilizing within 0.65s of attack onset) compared to AutoDRL-IDS. ANOVA results confirmed DeepEdgeIDS significantly outperformed AutoDRL-IDS in latency efficiency ( $p < 0.05$ ).
Resource Efficiency:
- Energy & Carbon: AutoDRL-IDS demonstrated higher energy efficiency and lower carbon emissions, maintaining a stable profile suitable for constrained devices. DeepEdgeIDS incurred higher aggregate CPU, energy, and carbon overhead due to its continuous online adaptation and feature extraction.
- CPU & Memory: AutoDRL-IDS maintained lower CPU usage (~25% vs. ~35% for DeepEdgeIDS). Memory usage differences were not statistically significant, with both models remaining within acceptable limits for edge gateways.
Statistical Significance: ANOVA tests confirmed that DeepEdgeIDS's superior detection probability and latency were statistically significant, while the differences in response time were not. The effect size indicated that model architecture was a dominant factor in detection efficacy.

Significance and Claims
The paper claims to establish a new benchmark for sustainable cybersecurity by demonstrating that DRL-based IDS can be optimized not just for accuracy, but for environmental impact. The study highlights a fundamental trade-off: DeepEdgeIDS offers superior adaptability, faster response to zero-day threats, and higher detection accuracy at the cost of higher energy and carbon consumption. Conversely, AutoDRL-IDS provides a more energy-efficient, stable, and predictable solution suitable for resource-constrained environments where labeled data is available for training.

The authors assert that their work fills a critical gap by moving beyond pure detection accuracy to include sustainability as a core optimization objective. They conclude that these architectures advance the development of self-adaptive, sustainable security frameworks for next-generation IoT ecosystems, offering a practical foundation for balancing accuracy, resource efficiency, and robustness in dynamic edge networks.