Abstract
The rapid proliferation of resource-constrained Internet of Things (IoT) devices has significantly expanded the attack surface of modern networks, rendering traditional signature-based defences ineffective against novel and polymorphic threats. This paper introduces DodgE, a lightweight hybrid framework that combines an ensemble of shallow autoencoders for unsupervised anomaly detection with a Random Forest–based module for device fingerprinting. DodgE operates at the edge gateway level, processing fixed-window network flow summaries and raising alerts when reconstruction errors exceed dynamic thresholds or when predicted device identities diverge from claimed identifiers. Evaluated on the N-BaIoT dataset (1.41 million flows), DodgE achieves 96.2% overall accuracy and a 0.98 F1-score, outperforming both anomaly-only and fingerprint-only baselines. With an inference latency under 150 ms and a memory footprint below 50 MB, DodgE meets real-time performance constraints and offers robust protection against both behavioral and identity-based threats.