Abstract

Internet of Things (IoT) devices are vulnerable to denial-of-service attacks but often lack resources for conventional intrusion detection. This study develops an Adaptive Online Sequential Extreme Learning Machine (AOS-ELM) intrusion detection system for monitoring ESPHome–Home Assistant Native API traffic on edge devices. Its novelty lies in combining fixed five-second flow-level feature extraction, sequential AOS-ELM updates with bounded forgetting-factor adaptation, and live evaluation on Raspberry Pi 5 and LattePanda v1. Real-time operation was verified by capturing mirrored traffic, processing completed flow windows, producing NORMAL or ATTACK decisions, and recording per-flow inference time and memory usage during normal and attack conditions. On Raspberry Pi 5, the system achieved 98.34% accuracy, 99.55% precision, 97.21% recall, and 98.36% F1-score, with average inference latency of 121.88 ms per flow. LattePanda v1 achieved 81.54% accuracy, 59.81% precision, 100% recall, and 74.85% F1-score. The lightweight claim is supported by successful execution on both edge devices, bounded inference latency, and moderate IDS-process RAM growth under attack conditions. Results indicate that the proposed framework can update sequentially and respond to tested traffic variations without full retraining, supporting its use as a lightweight adaptive IDS for edge-based IoT infrastructure.