Cross-Tier ML Intrusion Detection for Resource-Constrained Environmental IoT Sensor Networks

Compromised Internet of Things (IoT) sensor networks in critical infrastructure such as water-quality monitoring carry direct public-health consequences, yet intrusion-detection research rarely combines threat modelling, hardware-constrained deployment and regulatory mapping. This study applies the STRIDE framework to the 14 attack classes of the Edge-IIoTset dataset, evaluates six classifiers across a Raspberry Pi 4 gateway tier and an ESP32-C6 sensor tier, and maps detection results to NIS2 Article 21(2) via ENISA guidance. Since NIS2 sets no quantitative threshold, ≥80% correct attack-type identification is used as a study-defined operational threshold for detection evidence toward NIS2 compliance. Binary detection reaches 100% with 0% false positive rate on both tiers. At the gateway, Random Forest is strongest at 92.4% balanced accuracy, covering 13 of 14 classes at the threshold, followed by Decision Tree at 91.8% with the same coverage. Both fit the Pi 4 RAM budget, while the artificial neural network and convolutional neural network exceed it. At the sensor, no model reaches the threshold overall. Logistic Regression leads at 72.0% with 8 of 14 classes, and 12 of 14 attack types clear the threshold via the best deployable model, with the compressed Decision Tree most energy-efficient. The framework provides evidence that contributes to, but does not by itself establish, compliance with three Article 21(2) clauses, partial evidence for five, and none for two, tying detection performance to NIS2 subclauses under real hardware constraints while clarifying which clauses remain organisational obligations.