CAMELOT-IDS: a multi-scale transformer with empirical uncertainty diagnostics for IoT intrusion detection
Year: 2026
Type: article
Abstract: Internet of Things (IoT) intrusion detection must address severe class imbalance, heterogeneous traffic, and potential distribution shift while providing interpretable information about predictive uncertainty. CAMELOT-IDS integrates semantic local-global Transformer encoding, hierarchical supervision, Label-Distribution-Aware Margin loss with deferred reweighting (LDAM-DRW), deterministic Mondrian Regularized Adaptive Prediction Sets (RAPS), and stream-oriented monitoring. On the reported CICIoT2023 analysis subset, the reference model achieved 99.20% fine-class accuracy, 76.76% fine-class macro-F1, and 99.79% malicious-class F1. At α = 0.10, the deterministic RAPS implementation produced 99.95% empirical coverage with a mean prediction-set size of 1.60. Because probability scaling and RAPS-threshold estimation reused the same labeled calibration pool, these set-valued results are interpreted as empirical diagnostics rather than as a formal split-conformal validity result. Batch throughput was 18,141.6 samples/s on an NVIDIA RTX 3060 and 1062.3 samples/s on the tested dual-Xeon platform. Fine-class performance remained highly uneven, with the Uploading Attack class yielding an F1 score of 4.96%. The stream-monitoring pathway produced no trigger during the held-out stream replay. These findings support further provenance-aware external validation, dependence-aware calibration, and controlled distribution-shift evaluation.
Source: Scientific Reports
Language: English
Subfield: Computer Networks and Communications
Field: Computer Science
Domain: Physical Sciences
Open Access status: gold
Estimated APC paid: $2,690
Award: G8596239825
OpenAlex ID: W7225001219