LEGCID: Lightweight Edge-Generated Classifier for Intrusion Detection on OpenWrt

Proposes LEGCID, an edge-native intrusion detection architecture deployed directly on commodity OpenWrt home gateways. The system trains a sparsified 30-feature random forest on IoT botnet traffic, compiles it into dependency-free C99 source via emlearn, and executes in-process flow classification directly from conntrack data with kernel-level nftables quarantine. It operates within strict embedded budgets—achieving 2.9 µs per-inference latency and a 772 KB resident set size while eliminating cloud telemetry egress and recurring compute costs.