LITH: A Lightweight Behavioral Anomaly-to-Hunt-Lead Framework for IoT Sensor Ecosystems.
- 1Faculty of Computing & Information Technology, King Abdulaziz University, Jeddah 21589, Saudi Arabia.
Abstract
Internet of Things (IoT) sensor ecosystems increasingly support critical services, yet many endpoints cannot host conventional security stacks because of limited processing and memory resources. This paper presents the Lightweight IoT Threat Hunter (LITH), a hybrid endpoint-edge-central anomaly-to-hunt-lead framework that converts compact behavioral telemetry into calibrated, ranked investigation leads for downstream threat-hunting workflows while keeping automated anomaly detection separate from analyst confirmation. The framework was evaluated using a controlled multidevice telemetry benchmark across 10 Monte Carlo runs, with benign-only model fitting and validation-based anomaly-score calibration. At the common 99th-percentile operating point, One-Class Support Vector Machine (SVM) achieved the highest mean thresholded F1-score, although its difference from the autoencoder was not statistically significant after Holm correction, while Isolation Forest achieved the strongest mean Area Under the Receiver Operating Characteristic Curve (ROC-AUC) and average precision. Network-only telemetry retained performance close to the combined network-and-system feature set, while system-only telemetry was substantially weaker for the evaluated attack scenarios. Robustness and operating-point analyses showed that performance degrades under weaker attacks and increased benign variability and that higher sensitivity to subtle exfiltration behavior requires accepting a larger benign investigation workload. Beyond anomaly classification, LITH converts high-scoring observations into device-class-specific ranked hunt leads with behavioral indicators intended to support analyst triage rather than autonomous threat attribution. A limited three-feature external stress test on the Canadian Institute for Cybersecurity's (CICIoT2023) dataset produced markedly different detector behavior: Max-Z achieved an F1-score of 0.824 and ROC-AUC of 0.835, while Isolation Forest did not transfer reliably at the fixed 99th-percentile operating point. This class-dependent result shows that the detector ranking observed in the controlled benchmark does not generalize uniformly. The results support proof-of-concept feasibility while emphasizing that broader device-aware external validation and physical endpoint and edge measurements remain necessary before claims of generalization or deployment readiness can be made.
Related
- OpsSatNet: A Lightweight Sensor-Aware Attention Network for Satellite Telemetry Anomaly Detection
- A Lightweight Real-Time Vision Framework for Low-Disturbance Veterinary Management and Behavioral Welfare Assessment in Captive Forest Musk Deer
- A reproducible neuro-fuzzy framework for interpretable anomaly detection in wireless sensor network data streams
- A lightweight knowledge distillation framework for few shot unsupervised industrial surface anomaly detection and localization
- A Lightweight Multi-Sensor Feature-Level Fusion Framework for Noise-Robust Fault Diagnosis of High-Precision Milling Machines.
BibTeX
@article{bamashmoos2026lith,
title = {{LITH: A Lightweight Behavioral Anomaly-to-Hunt-Lead Framework for IoT Sensor Ecosystems.}},
author = {Fatmah Bamashmoos and Enas Khairullah},
journal = {Sensors (Basel, Switzerland)},
year = {2026},
month = oct,
doi = {10.3390/s26206618},
url = {https://europepmc.org/article/MED/42944480},
note = {CC BY},
}
RIS
TY - JOUR
TI - LITH: A Lightweight Behavioral Anomaly-to-Hunt-Lead Framework for IoT Sensor Ecosystems.
AU - Fatmah Bamashmoos
AU - Enas Khairullah
PY - 2026
DA - 2026/10/19
JO - Sensors (Basel, Switzerland)
DO - 10.3390/s26206618
UR - https://europepmc.org/article/MED/42944480
AB - Internet of Things (IoT) sensor ecosystems increasingly support critical services, yet many endpoints cannot host conventional security stacks because of limited processing and memory resources. This paper presents the Lightweight IoT Threat Hunter (LITH), a hybrid endpoint-edge-central anomaly-to-hunt-lead framework that converts compact behavioral telemetry into calibrated, ranked investigation leads for downstream threat-hunting workflows while keeping automated anomaly detection separate from analyst confirmation. The framework was evaluated using a controlled multidevice telemetry benchmark across 10 Monte Carlo runs, with benign-only model fitting and validation-based anomaly-score calibration. At the common 99th-percentile operating point, One-Class Support Vector Machine (SVM) achieved the highest mean thresholded F1-score, although its difference from the autoencoder was not statistically significant after Holm correction, while Isolation Forest achieved the strongest mean Area Under the Receiver Operating Characteristic Curve (ROC-AUC) and average precision. Network-only telemetry retained performance close to the combined network-and-system feature set, while system-only telemetry was substantially weaker for the evaluated attack scenarios. Robustness and operating-point analyses showed that performance degrades under weaker attacks and increased benign variability and that higher sensitivity to subtle exfiltration behavior requires accepting a larger benign investigation workload. Beyond anomaly classification, LITH converts high-scoring observations into device-class-specific ranked hunt leads with behavioral indicators intended to support analyst triage rather than autonomous threat attribution. A limited three-feature external stress test on the Canadian Institute for Cybersecurity's (CICIoT2023) dataset produced markedly different detector behavior: Max-Z achieved an F1-score of 0.824 and ROC-AUC of 0.835, while Isolation Forest did not transfer reliably at the fixed 99th-percentile operating point. This class-dependent result shows that the detector ranking observed in the controlled benchmark does not generalize uniformly. The results support proof-of-concept feasibility while emphasizing that broader device-aware external validation and physical endpoint and edge measurements remain necessary before claims of generalization or deployment readiness can be made.
SN - 1424-8220
ER -