Nicho, MCusack, BMcDermott, CDGirija, S2025-05-112025-05-112025-04-24Information Security Journal, ISSN: 1939-3555 (Print); 1939-3547 (Online), Informa UK Limited, ahead-of-print(ahead-of-print), 1-21. doi: 10.1080/19393555.2025.24963271939-35551939-3547http://hdl.handle.net/10292/19174IoT systems face vulnerabilities due to their data processing requirements and resource constraints. With 13 billion connected devices globally, this research investigates the economic viability of AI-based intrusion detection systems (IDSs), specifically analyzing the automation costs of implementing a Convolutional Neural Network (CNN) with Long Short-Term Memory (LSTM) for classifying malicious sensor traffic. This study introduces an innovative framework that evaluates six distinct architectural components of CNN and LSTM: image input processing, convolutional layer operations, max pooling layer functionality, fully connected layer characteristics, softmax output activation, and class determination mechanisms. The framework employs six metrics: matrix size, feature vector number, input vector size, output vector size, and number of runs for dual data points. Experiments on the IoT-23 dataset showed our proposed CNN model outperformed LSTM, achieving 93% accuracy for binary classification and 96% for multi-class classification. The trained CNN demonstrated predictable resource utilization with increasing classification complexity, providing a framework for quantifying IoT IDS costs. The proposed framework provides a systematic methodology for evaluating machine learning classifiers in IoT environments, using quantitative metrics to assess implementation and operational costs, enabling data-driven selection of optimal security solutions based on specific deployment constraints.© 2025 The Author(s). Published with license by Taylor & Francis Group, LLC. This is an Open Access article distributed under the terms of the Creative Commons Attribution-NonCommercial License (http://creativecommons.org/licenses/by-nc/4.0/), which permits unrestricted non-commercial use, distribution, and reproduction in any medium, provided the original work is properly cited. The terms on which this article has been published allow the posting of the Accepted Manuscript in a repository by the author(s) or with their consent.http://creativecommons.org/licenses/by-nc/4.0/4605 Data Management and Data Science46 Information and Computing Sciences4611 Machine LearningNetworking and Information Technology R&D (NITRD)BioengineeringMachine Learning and Artificial Intelligence0802 Computation Theory and Mathematics0804 Data Format4604 Cybersecurity and privacyJournal ArticleOpenAccess10.1080/19393555.2025.2496327