A Lightweight LoRA-Adapted GRU Autoencoder with Directional Drift Detection for Encrypted IoT Anomaly Detection

Internet of Things (IoT) traffic shifts as device communication patterns evolve, potentially reducing the reliability of static intrusion detectors. Existing drift monitors detect distributional changes but do not inherently distinguish shifts requiring model adaptation from those warranting security alerts. This paper proposes an unsupervised framework for encrypted IoT traffic using a unidirectional gated recurrent unit (GRU) autoencoder trained on benign flows. Two Page–Hinkley (PH) statistics monitor reconstruction error: PH-UP triggers low-rank adaptation (LoRA), while PH-DOWN raises an alert without adaptation. Following adaptation, the detection threshold is recalibrated using an unlabelled window. On the CIC IoT-DIAD 2024 dataset, the static detector achieved an F1 score of 0.9518 and a false-positive rate (FPR) of 1.11%. Under synthetic covariate shift, its F1 score fell to 0.7241 (FPR: 55.7%), while Rank-8 LoRA achieved 0.9550 (FPR: 1.45%). Across five random seeds, the adapted system achieved an F1 score of 0.9438 ± 0.0207, but performance on the original traffic fell to 0.9239 ± 0.0415. PH-UP detected the simulated shift, while PH-DOWN raised an alert on a simulated brute-force error window. Evaluation was limited to one dataset, constructed error streams, and cloud central processing unit (CPU) experiments; adaptive-evasion attacks and edge hardware remain unevaluated.