Optimizing IoT Intrusion Detection with Tabular Foundation Models for Smart City Forensics
arXiv:2604.11394v1 [cs.CR] 13 Apr 2026
Asma Al-Dahmani1,∗ , Abdulla Bin Safwan1,∗ , Mohammad Obeidat2 , and Belal Alsinglawi1,∗∗ 1
2
Zayed University, Abu Dhabi, United Arab Emirates Higher Colleges of Technology, Abu Dhabi, United Arab Emirates [email protected] ∗
These authors contributed equally to this work. ∗∗ Corresponding author.
Abstract. Security operations in smart cities demand detection systems that balance accuracy with response time. While ensemble methods like Random Forest achieve high accuracy, their computational overhead impedes real-time forensic triage. We present the first systematic evaluation of TabPFNv2.5, a transformer-based foundation model, against traditional ensemble classifiers for IoT intrusion detection. Using the TON IoT dataset, we demonstrate that TabPFNv2.5 achieves 40× faster inference than Random Forest while maintaining 97% binary classification accuracy. We propose a hybrid pipeline in which TabPFNv2.5 performs rapid threat screening, while ensemble models handle detailed classification. Our analysis reveals that scanning attacks remain the hardest to detect (F1: 69.8%) and cross-device generalization depends critically on feature similarity. These findings establish foundation models as viable components for time-sensitive IoT security operations. Keywords: IoT Security · Intrusion Detection · TabPFNv2.5 · Random Forest · Smart Cities · Digital Forensics · Foundation Models · Machine Learning
1
Introduction
The expansion of Internet of Things (IoT) devices in urban infrastructure has fundamentally altered the cybersecurity landscape. Modern smart cities integrate millions of interconnected sensors, actuators, and controllers that manage transportation networks, energy grids, and public services [1]. This interconnectivity, while enabling operational efficiency, creates expansive attack surfaces where adversaries can compromise multiple subsystems within minutes of initial breach [2]. Security analysts face a critical operational challenge: they must rapidly assess diverse telemetry streams from heterogeneous devices while maintaining
2
Al-Dahmani et al.
classification accuracy sufficient for forensic documentation. Current machine learning approaches, particularly ensemble methods such as Random Forest and Gradient Boosting, deliver excellent accuracy but impose computational overhead that conflicts with real-time investigation requirements [3]. This tension between speed and accuracy represents a fundamental barrier to effective IoT security operations. Existing intrusion detection research has extensively validated ensemble methods for IoT environments, consistently demonstrating accuracy exceeding 99% on benchmark datasets [4] [5]; however, three critical gaps persist in the literature. First, the computational cost of ensemble training and inference has received limited attention despite its operational significance, as Security Information and Event Management (SIEM) systems process thousands of events per second, and models that require hundreds of milliseconds per inference can create bottlenecks that delay threat identification. Second, foundation models— pre-trained architectures that generalize across tasks without retraining—have transformed natural language processing and computer vision, yet their application to cybersecurity tabular data remains largely unexplored; TabPFNv2.5 [6] [7] represents a promising candidate by delivering millisecond-level inference using frozen weights, thereby eliminating training overhead entirely. Third, existing evaluations rarely quantify the speed–accuracy tradeoff in terms meaningful to security practitioners, leaving unclear how much accuracy must be sacrificed to achieve real-time capability and whether hybrid architectures can mitigate this tradeoff. This paper addresses these gaps through a comprehensive empirical study. Our contributions are: (1) a first systematic comparison of TabPFNv2.5 against ensemble methods for IoT intrusion detection, evaluating binary and multiclass classification across seven device categories using 3.6 million telemetry records; (2) quantification of the speed–accuracy tradeoff, demonstrating that TabPFNv2.5 achieves 40× faster inference than Random Forest with only a 2.3% reduction in binary accuracy, thereby establishing concrete parameters for deployment decisions; (3) a hybrid forensic investigation pipeline that utilizes TabPFNv2.5 for rapid threat triage while preserving ensemble accuracy for detailed classification, aligning with SIEM-driven workflows; (4) a cross-device generalization analysis revealing that model transferability depends critically on feature similarity, with implications for heterogeneous IoT deployments; and (5) an attack-specific detection analysis identifying scanning as the most challenging category (F1: 69.8%) due to its behavioral similarity to benign reconnaissance. The remainder of this paper proceeds as follows. Section 2 reviews IoT security challenges and relevant machine learning approaches. Section 3 describes our dataset, proposed pipeline, and experimental configuration. Section 4 presents classification performance, computational efficiency, and generalization results. Section 5 discusses practical implications and limitations. Section 6 concludes with future research directions.
3
2
Background and Literature Review
2.1
Smart City IoT Security Landscape
Smart city environments all depend on IoT and Industrial IoT (I-IoT) interconnectedness to support urban services such as transportation systems, energy distribution, healthcare, and community safety [8]. Implementation refines efficiency and automation, expanding the attack surface across multiple devices, protocols, and network layers. The use of 5G increases complexity and connectivity density, allowing attackers to gain access to multiple devices quicker once a backdoor has been found [9]. Realistically, smart cities are exposed to various high-impact threats such as DDoS attacks, brute-force attacks, injection activity (e.g., XSS and SQL), and large-scale surveillance scanning [1,2]. The vulnerability lies in how quick an attacker can gain lateral access through an interconnected system, leading to disruptions of critical services. 2.2
Machine Learning fort Intrusion Detection
Machine learning-based intrusion detection has become the dominant approach for detecting anomalous network behavior, replacing signature-based methods that struggle to identify novel threats [3]. Ensemble techniques have proven particularly effective. Random Forest combines multiple decision trees trained on bootstrap samples, improving accuracy while maintaining interpretability through feature importance analysis. Gradient Boosting sequentially refines models by correcting residual errors, often achieving higher accuracy at the expense of increased computational complexity [10]. Prior studies validate ensemble methods in IoT environments. Ashraf et al. [1] proposed a scalable IDS for smart city networks capable of handling heterogeneous, high-volume traffic. Alhowaide et al. [4] showed that ensemble decision trees provide strong baselines for cloud-based IDS by balancing detection performance and inference latency. Despite their effectiveness, ensemble models typically require task-specific training, leading to increased computational cost and reduced efficiency in dynamic environments requiring frequent updates. 2.3
Foundation Models for Tabular Data
Foundation models have revolutionized machine learning by demonstrating that pre-trained architectures can generalize effectively across diverse downstream tasks. While transformers have dominated text and image domains, their application to tabular data has emerged more recently. TabPFN [6] introduced a prior-data fitted network that performs Bayesian inference through forward passes, eliminating the need for task-specific training. TabPFNv2.5 [7] [11] extends this approach with improved scalability, achieving competitive accuracy on datasets up to 10,000 samples while maintaining millisecond-level inference using frozen weights.
4
Al-Dahmani et al.
Table 1: Dataset composition: device categories and attack type distribution Device Category
Records
Normal
Attack
Attack Rate
Smart Refrigerator Garage Door GPS Tracker Modbus (IIoT) Motion Light Thermostat Weather Station
587,076 591,446 595,686 287,194 452,262 442,228 650,242
500,827 515,443 513,849 222,855 388,328 385,953 559,718
86,249 76,003 81,837 64,339 63,934 56,275 90,524
14.7% 12.9% 13.7% 22.4% 14.1% 12.7% 13.9%
3,606,134
3,086,973
519,161
14.4%
Attack Type
Count
%
Attack Type
Count
%
Backdoor Password DDoS Injection
246,136 142,674 53,992 50,319
47.4 27.5 10.4 9.7
Ransomware XSS Scanning
16,030 6,037 3,973
3.1 1.2 0.8
Total
The cybersecurity implications of this capability are significant. In forensic contexts, analysts frequently encounter novel attack patterns that traditional models have not seen during training. Foundation models’ ability to generalize without retraining offers potential for rapid assessment of emerging threats. However, empirical validation of this capability for intrusion detection remains limited, motivating our systematic evaluation.
3
Methodology
3.1
Dataset Description
We employ the TON IoT dataset [12], a comprehensive telemetry collection designed for IoT intrusion detection research. The dataset comprises network traffic from seven device categories spanning consumer IoT (smart refrigerator, garage door controller, GPS tracker, etc.) and industrial IoT (Mod bus controller), totaling 3,606,134 records. Table 1 presents device-level statistics and attack type distributions. The Mod bus industrial controller exhibits the highest attack rate (22.4%), consistent with adversaries’ strategic targeting of operational technology to maximize disruption. Attack type distribution reveals significant class imbalance: backdoor and password attacks dominate (74.9% combined), while scanning— the reconnaissance precursor to active exploitation— accounts for only 0.8% of malicious traffic. This imbalance presents detection challenges that our evaluation explicitly addresses.
Input
5
Raw IoT Telemetry
Data Preprocessing
Rapid Triage
Feature Engineering
TabPFNv2.5 Triage
normal
Benign Log
Deep Analysis
suspicious
Ensemble Classifiers Random Forest
Gradient Boost
Consensus Voting
Attack Classification
Forensic Report
Fig. 1: Hybrid forensic investigation pipeline. TabPFNv2.5 performs millisecondlevel threat screening; suspicious traffic proceeds to ensemble classifiers for detailed attribution.
3.2
Proposed Hybrid Investigation Pipeline
We propose a two-stage forensic investigation pipeline that addresses the fundamental tension between detection speed and classification accuracy. The architecture, illustrated in Figure 1, utilizes TabPFNv2.5’s rapid inference for initial threat triage while preserving ensemble methods’ accuracy for detailed attribution. The pipeline operates through three coordinated phases. In the pre-processing phase, raw telemetry undergoes temporal feature extraction (hour, day of week, minute),label-based categorical encoding, median-based imputation for missing values, and z-score normalization. The rapid triage phase uses TabPFNv2.5 with pre-trained weights to classify incoming traffic, routing normal records to audit logs and flagging suspicious records for detailed analysis. In the deep analysis
6
Al-Dahmani et al.
phase, flagged traffic passes through both Random Forest and Gradient Boosting classifiers; consensus voting determines final classification, with disagreement cases escalated for human analyst review. 3.3
Classification Models
We evaluate three classifiers representing distinct computational paradigms. Random Forest employs 100 decision trees with bootstrap sampling and unlimited depth, leveraging information gain for split selection. This configuration follows established best practices for network intrusion detection [4] and provides interpretability through feature importance rankings. Gradient Boosting constructs 100 sequential estimators with a learning rate of 0.1 and a maximum depth of 3, balancing expressiveness against overfitting risk. Both ensemble methods require task-specific training proportional to the dataset size. TabPFNv2.5 operates fundamentally differently: its transformer architecture (18–24 layers with alternating attention) processes input through pre-trained weights without any task-specific training [7]. The model achieves optimal performance on datasets with fewer than 10,000 samples; for larger datasets, we employ stratified subsampling to preserve class distributions. This design enables millisecond-level inference regardless of the volume of historical training data. 3.4
Experimental Configuration
All experiments were executed on Google Colaboratory infrastructure with Intel Xeon processors and 12GB of RAM. Enactment requires Python 3.10 with scikitlearn 1.3.0, TabPFNv2.5, and standard data science libraries. We used an 80% - 20% train-test split with stratified sampling to maintain class distributions. Performance analyses use 5-fold cross-validation with mean metrics reported. Evaluation metrics include accuracy, precision, recall, and F1-score for both binary (attack/normal) and multi-class (specific attack type(s)) classification tasks. We report training time, inference time, and computational resource utilization to assess operational usability.
4
Experimental Results
4.1
Overall Classification Performance
Table 2 combines binary (attack vs. normal) and multi-class (attack type) performance across the seven TON IoT device categories. Random Forest is consistently the most accurate model, while TabPFNv2.5 remains competitive and is used as a quick screening layer rather than a replacement for ensemble-based final decisions. While TabPFNv2.5 is less accurate than ensemble standards, 97%+ binary accuracy still supports its role as a rapid triage: it can separate high-volume telemetry and prioritize abnormal flows for impending investigation, while keeping the final classification tied to higher-accuracy ensembles.
7
Table 2: Performance Overview by Device Type (Binary and Multi-Class Accuracy) Device
RF
Binary Accuracy GB TabPFNv2.5
Multi-Class Accuracy RF GB TabPFNv2.5
Fridge Garage Door GPS Tracker Mod bus Motion Light Thermostat Weather
99.49% 99.58% 99.45% 99.30% 99.55% 99.56% 99.47%
98.67% 98.74% 99.14% 98.48% 98.87% 99.35% 98.69%
97.3% 97.1% 97.5% 96.8% 97.4% 97.6% 96.9%
99.50% 99.55% 99.47% 99.29% 99.19% 99.58% 99.48%
99.51% 98.51% 98.93% 98.92% 99.10% 99.51% 98.53%
96.9% 96.5% 97.1% 96.4% 97.0% 97.2% 96.7%
Average
99.48%
98.85%
97.2%
99.44%
99.00%
96.8%
Table 3: Computational Performance Comparison (seconds) Metric Training Time (avg) Inference Time (10K samples) Total Pipeline Time
Random Forest
Gradient Boosting
TabPFNv2.5
42.38 0.82 43.20
117.75 0.94 118.69
0.00* 0.02 0.02
*TabPFNv2.5 uses pre-trained weights; no task-specific training required.
4.2
Computational Efficiency and Time Latency
In practice, the most useful advantage of TabPFNv2.5 is time latency. Table 3 highlights that TabPFNv2.5 gains millisecond-level inference, pushing for SIEMdriven screening by alert prioritization, which reduces computational and time constraints instead of ensemble-based models. 4.3
Failure Modes and Hard-to-Detect Attacks
Across models, low-prevalence behaviors remain the dominant source of missed detections. In particular, scanning exhibits the lowest separability from benign activity, which is consistent with its surveillance nature. For multi-class detection using Random Forest, scanning has the lowest F1-score (69.80%), while higher-frequency behaviors, such as injection and benign traffic, maintain nearsaturated performance (99% F1). 4.4
Cross-Device Generalization (Compact)
Cross-device validation stipulates that transferability depends on feature similarity. Most models trained on Fridge data generalize to other sensor-driven devices (e.g., Thermostats, Motion Lights), but Garage Door models often correlate poorly with unrelated feature spaces, suggesting that heterogeneous deployments retain device-aware modeling.
8
Al-Dahmani et al.
Table 4: Hard-Case Detection Summary (Random Forest Multi-Class) Attack Type Scanning DDoS Ransomware
Precision
Recall
F1-Score
79.15% 95.35% 95.07%
64.20% 98.00% 98.50%
69.80% 96.65% 96.75%
Table 5: Cross-Device Generalization (Selected Results) Trained On
Tested On
Accuracy
Recall
Fridge Fridge Garage Door
Thermostat GPS Tracker Fridge
99.6% 97.9% 91.2%
98.8% 95.6% 54.5%
5
Discussion and Research Implications
5.1
Practical Implications for Smart City Security
Our findings establish TabPFNv2.5 as an option for time-sensitive IoT security investigations, addressing a critical gap in current forensic methodologies. The current hybrid pipeline architecture we propose enables security operation centers (SOCs) to perform a more rapid preliminary threat assessment without sacrificing classification accuracy for confirmed threats. The 40× inference speed advantage of TabPFNv2.5 converts directly into operational efficiency. In events where analysts must analyze thousands of potential security events, reducing the per-event assessment time from seconds to milliseconds enables more detailed coverage that would otherwise require immense staffing or computational resources. 5.2
Foundation Models in Cybersecurity
This study provides evidence that foundation-style transformers can be used in cybersecurity workflows where low-latency decisions are operationally critical. It also contributes to the nascent literature on foundation models. Our results show that pre-trained tabular transformers offer strong advantages for specific security tasks, specifically those that require quick inference on previously unseen data patterns. This suggests a promising direction: if foundation models are trained more directly on cybersecurity telemetry (rather than using synthetic tabular tasks), the accuracy gap can be reduced without sacrificing latency advantages. 5.3
Limitations
Several constraints limit the extent to which these results can be generalized. First, TON IoT is used on a large scale but does not capture the full complexity
9
of real-world production behavior in smart-city networks. Second, TabPFNv2.5 performs best on smaller sample sizes, requiring sub-sampling for large-scale telemetry and potentially leading to the exclusion of any minority-class behavior. Third, our evaluation focuses on known attack vectors, meaning true zero-day behavior is not accounted for, nor measure. Finally, timing results depend on the execution environment (e.g., Colab vs edge nodes); therefore, real practicality when deployed can differ.
5.4
Recommendations for Practitioners
Based on our experimental findings, we conclude that an effective and practical IoT security investigation strategy in smart city environments should prioritize inference speed without disregarding accuracy by adopting a hybrid, SIEM-aligned workflow. In particular, (i) TabPFNv2.5 should be employed for rapid front-end screening when early prioritization and real-time responsiveness are critical, (ii) Random Forest—optionally complemented by Gradient Boosting—should be used for detailed classification and confident attack attribution once suspicious events are flagged, (iii) ensemble agreement checks should be applied such that events with model disagreement are escalated for analyst review, (iv) scanning activities should be treated as high-risk for false negatives and validated using contextual signals such as timing, targeted ports, and device behavior, and (v) cross-device generalization should not be assumed, as heterogeneous IoT telemetry necessitates device-aware modeling or careful feature normalization.
6
Conclusion and Future Work
This paper presented a detailed comparison between TabPFNv2.5 transformerbased foundation models and traditional ensemble methods for IoT security incident investigation in smart city environments. Experiments conducted across seven IoT device categories and more than 3.6 million network traffic records demonstrate that while Random Forest achieves higher peak classification accuracy (99.44% for multi-class detection), TabPFNv2.5 attains competitive performance (96.8%) with substantially lower inference latency, enabling threat assessment in milliseconds rather than seconds. Overall, the results position tabular foundation models as effective frontend triage components within SIEM-driven workflows, where rapid screening is as critical as maximum accuracy. The proposed hybrid investigation pipeline leverages TabPFNv2.5 for fast initial detection and ensemble models for highconfidence attack attribution and reporting, offering a practical balance between speed and accuracy. Nevertheless, surveillance-style activities remain the most challenging to detect robustly, and cross-device generalization continues to depend heavily on feature similarity across IoT systems.
10
Al-Dahmani et al.
References 1. Ashraf, J., Keshk, M., Moustafa, N., Abdel-Basset, M., Khurshid, H., Bakhshi, A.D., Mostafa, R.R.: IoTBoT-IDS: A novel statistical learning-enabled botnet detection framework for protecting networks of smart cities. Sustainable Cities and Society 72, 103041 (2021). doi:10.1016/j.scs.2021.103041 2. Abdel-Basset, M., Moustafa, N., Hawash, H., Razzak, I., Sallam, K.M., Elkomy, O.M.: Federated intrusion detection in blockchain-based smart transportation systems. IEEE Transactions on Intelligent Transportation Systems 23(3), 2523–2537 (2022). doi:10.1109/TITS.2021.3119968 3. Khraisat, A., Alazab, A.: A critical review of intrusion detection systems in the Internet of Things: techniques, deployment strategy, validation strategy, attacks, public datasets and challenges. Cybersecurity 4, 18 (2021). doi:10.1186/s42400021-00077-7 4. Alhowaide, A., Alsmadi, I., Alsinglawi, B.: Ensemble-based cyber intrusion detection for robust smart city protection. In: IEEE International Conference on Distributed Computing in Smart Systems and the Internet of Things (DCOSS-IoT), pp. 124–129 (2024) 5. Al-Omari, M., Rawashdeh, M., Qutaishat, F., Alshira’H, M., Ababneh, N.: An intelligent tree-based intrusion detection model for cyber security. Journal of Network and Systems Management 29, 1–18 (2021). doi:10.1007/s10922-021-09591-y 6. Hollmann, N., Müller, S., Eggensperger, K., Hutter, F.: TabPFN: A transformer that solves small tabular classification problems in a second. In: International Conference on Learning Representations (ICLR) (2023). arXiv:2207.01848. doi:10.48550/arXiv.2207.01848 7. Ye, H.-J., Liu, S.-Y., Chao, W.-L.: A closer look at TabPFN v2: Understanding its strengths and extending its capabilities. arXiv:2502.17361 (2025). doi:10.48550/arXiv.2502.17361 8. Khan, I.A., Moustafa, N., Pi, D., Sallam, K.M., Zomaya, A.Y., Li, B.: A new explainable deep learning framework for cyber threat discovery in industrial IoT networks. IEEE Internet of Things Journal 9(13), 11604–11613 (2022). doi:10.1109/JIOT.2021.3130156 9. Scalise, P., Boeding, M., Hempel, M., Sharif, H., Delloiacovo, J., Reed, J.: A systematic survey on 5G and 6G security considerations, challenges, trends, and research areas. Future Internet 16(3), 67 (2024). doi:10.3390/fi16030067 10. Grinsztajn, L., Oyallon, E., Varoquaux, G.: Why do tree-based models still outperform deep learning on tabular data? arXiv:2207.08815 (2022). doi:10.48550/arXiv.2207.08815 11. Grinsztajn, L. et al.: TabPFN-2.5: Advancing the state of the art in tabular foundation models. arXiv:2511.08667 (2025). doi:10.48550/arXiv.2511.08667 12. Alsaedi, A., Moustafa, N., Tari, Z., Mahmood, A., Anwar, A.: TON IoT telemetry dataset: A new generation dataset of IoT and IIoT for datadriven intrusion detection systems. IEEE Access 8, 165130–165150 (2020). doi:10.1109/ACCESS.2020.3022862