2.1. Advances in AI-Based Intrusion Detection

The growing demand for intelligent security in IoT has led to the development of numerous AI-driven frameworks. A hybrid FFN–LSTM model proposed by [14] achieved over 99% accuracy on benchmark datasets, yet failed to detail data preparation, making their approach difficult to replicate in real-world conditions.

Popular AI models, such as recurrent neural networks (RNNs), LSTM networks, and transformers, have been applied in network security research [15]. However, their high computational demands make them impractical for low-power sensor nodes. In contrast, FFNs offer efficient network attack detection due to their simplicity and adaptability [9]. By adjusting the number of hidden layers and neurons per layer, FFNs can be optimized for either low-latency shallow models or more complex deep models. Shallow architectures, with a single hidden layer and numerous neurons, reduce model complexity while retaining pattern recognition but struggle with hierarchical data representation. Deep models, consisting of multiple hidden layers, capture hierarchical structures but demand greater computational resources [16]. This trade-off makes adaptive shallow–deep models an effective solution for attack detection in sensor networks, balancing accuracy and computational efficiency.

An RNN–GRU hybrid model introduced by [17] allows strong detection at the application layer, but its computational complexity raises concerns for edge-based deployment. Comparing FFN, LSTM, and random neural network (RandNN) in the CIC-IoT2022 dataset [18] demonstrates impressive detection rates, though they neglected practical deployment factors like memory consumption. Focusing on energy-efficient DL, Ravikumar et al. [19] found that model complexity remained a barrier for constrained sensor nodes.

Other works have taken broader perspectives. Surveying 5G-enabled IoT security [20] offered few AI-based mitigation strategies. Exploring decision tree–based NGFWs for DDoS detection [21] archives higher speed, but their method lacked adaptability to changing attack patterns. Ahmadi [6] performed a comparative analysis of AI-powered NGFWs but noted limitations in empirical evaluation and deployment testing.

Addressing data privacy, Dhakal et al. [22] used federated learning for distributed intrusion detection. While promising, the approach increased communication overhead and latency. Reinforcement learning (RL) was explored by [23] highlighting its potential in adaptive firewalls but at the cost of high training complexity. Emphasizing adversarial resilience, Khaleel et al. [24] advocate for defense strategies like adversarial training and defensive distillation, yet practical evaluation remains sparse.

2.2. AI-Powered NGFW Sensor Networks

Traditional network firewalls rely on perimeter-based security models, which are ineffective in sensor network environments due to the distributed and resource-limited nature of sensor nodes. In contrast, NGFWs integrated with AI models enable real-time attack detection with adaptive security enforcement [11]. Additionally, their use as reverse proxy systems helps mask sensor identities and reduce network congestion [25]. This study builds on [26] by leveraging shallow and deep AI models to develop an NGFW tailored for sensor networks. The proposed adaptive NGFW dynamically switches between shallow and deep AI models based on network conditions and resource constraints, ensuring real-time attack detection and effective attack prevention.

2.3. Similar Work in Sensor Network Security

Analyzing WSN application security [4] highlights the need for improved security techniques. However, it lacks identification of AI-based solutions to enhance security. Examining intrusion detection mechanisms in sensor networks [20] highlights challenges in handling large sensor data volumes and heterogeneous security protocols.

Conducting a literature review, Ali et al. [15] explore IoT security requirements and artificial neural network (ANN) approaches to address specific security features, comparing ANN-based security mechanisms for IDS to identify research gaps. However, the study overlooks issues such as overfitting, scalability, adversarial attacks, hyperparameter sensitivity, and vanishing gradient problems in ANN. Developing a hybrid FFN–LSTM model for sensor-based network attack detection, Jullian et al. [14] achieved 99.95% accuracy on NSL-KDD and BoT-IoT datasets; however, their methodology lacks clarity in data preprocessing and merging.

Discussing AI-powered IoT security, Ravikumar et al. [19] emphasize energy efficiency and adaptability, yet computationally intensive DL models remain impractical for low-power sensor nodes. Introducing an RNN–GRU hybrid model using the ToN-IoT dataset, Khan et al. [17] achieved 98% accuracy at the application layer but with increased latency and a higher risk of overfitting. Evaluating FFN, LSTM, and RandNN for IoT security using the CIC-IoT22 dataset, Bakhsh et al. [18] achieved high accuracy but overlooked resource efficiency and deployment constraints. Exploring ANNs in detecting network attacks on IoT application servers, Meeegammana and Fernando [9] highlight the potential of DL to enhance IoT security. However, it lacks a comparison with other ML models, scalability analysis, and testing in real-world IoT scenarios.

Conducting a review on NGFWs, Ahmadi [6] provides a comparative analysis of AI-based NGFW methodologies, highlighting their strengths and limitations. The study examines ML, DL, hybrid models, behavioral analysis, real-time threat intelligence, and adversarial defense mechanisms, evaluating detection accuracy, false positives, computational efficiency, adaptability, scalability, and robustness. However, it lacks discussion on explainability, scalability, and vulnerabilities to adversarial attacks and defenses, as well as limited empirical evaluation, unclear method selection, and insufficient benchmarking.

The universal approximation theorem establishes that a FFN with a single hidden layer can approximate any continuous function to arbitrary precision, provided it has a sufficient number of neurons and a suitable activation function [27]. However, FFN training faces gradient challenges and overfitting, which require mitigation through tuning activation functions, gradient clipping, batch normalization, and the use of regularization techniques. In their review of adversarial attacks and defense strategies in DL [24], they highlight evasion attacks, poisoning attacks, model inference attacks, and adversarial example transferability. They propose adversarial training, defensive distillation, and input preprocessing as defense mechanisms. However, the study lacks a deeper focus on practical applications with empirical evidence and overlooks key defenses, such as model ensembling and randomization. Table 1 compares the reviewed literature, where RUA denotes resource utilization assessment. Explainability and ethics are also critical in AI-based solutions. Sutaria [29] warned about bias and fairness in AI decision-making, especially when training data is unbalanced or nonrepresentative, which is an issue prevalent in many reviewed systems.

The above studies highlight several gaps. Majid et al. [4] call for improved security but overlook AI-based solutions, while Ali et al. [15] neglect issues like overfitting and scalability, Jullian et al. [14] and Khan et al. [17] face challenges with overfitting and latency, and Bakhsh et al. [18] and Meeegammana and Fernando [9] ignore resource efficiency and real-world deployment. Ahmadi [6] and Wang et al. [27] lack sufficient empirical evaluation and discussion of FFN challenges, limiting practical insights. Abid et al. [30], while advancing detection performance with the CNN–LSTM hybrid model, do not address edge optimization and lightweight deployment concerns. Most studies fail to address model bias from data imbalance and fail to address data balancing or hyperparameter tuning. These gaps indicate the need for comprehensive AI-driven security solutions in sensor networks.

2.4. AI-Based Attack Detection Solutions

Table 2 presents a comparison of AI-based attack detection solutions against the proposed NGFW, highlighting their strengths, weaknesses, and overall effectiveness in real-time, resource-constrained environments.

Unlike traditional AI-based firewalls that rely on static models or require frequent retraining, the proposed NGFW dynamically switches between shallow and deep models based on real-time network conditions. This adaptability ensures a balance between accuracy and efficiency, making it more suitable for resource-constrained environments. Compared to RL and FL-based firewalls, which demand continuous learning and high computational power, the proposed NGFW is optimized for low-resource settings. It also maintains high accuracy with minimal latency while eliminating the need for frequent retraining, ensuring scalability and efficiency in sensor networks with fluctuating resource availability.

2.5. Contribution of This Study

This study examines the deployment of a lightweight, energy-efficient AI-based adaptive NGFW for attack detection in resource-constrained sensor networks. It is an area largely unexplored. By integrating a defense-in-depth strategy, the adaptive NGFW enhances real-time attack detection while optimizing security, resource efficiency, and adaptability in distributed sensor environments. The proposed solution sets a novel future direction for adaptive security in sensor networks.

3.1. Foundation and Prior Work

The adaptive NGFW proposed in this study builds upon the prior work of [26], who developed four AI models (shallow20, deep20, shallow40, and deep40) optimized for attack detection in edge networks. These models incorporate both shallow and deep architectures to balance computational efficiency and detection accuracy. The shallow models, intended for low-resource environments, consist of a single hidden layer with 512 neurons, whereas the deep models feature seven hidden layers with progressively fewer neurons (256, 128, 64, 32, 16, 8, and 4) to capture complex attack patterns. Two feature sets (20 and 40 features) were used to enhance adaptability across varying resource conditions. To optimize model performance and fairness, hyperparameter tuning including activation function optimization and dropout regularization was conducted using KerasTuner’s random search method. To address potential data imbalance, the UNSW-NB15 dataset [31] was preprocessed using random undersampling, ensuring equal representation of attack and benign classes and thereby improving model generalization. The dataset was ultimately narrowed down to 186,000 instances. Further preprocessing involved min–max scaling of feature values, followed by a split into training (90%), validation (5%), and testing (5%) sets for robust and unbiased evaluation.

The four trained models were evaluated based on key performance metrics (accuracy, precision, recall, F1 score, and ROC-AUC), alongside resource utilization metrics (model size, memory, and CPU usage). The models achieved test accuracies ranging from 0.93 to 0.98, with deep models excelling in classification (ROC-AUC: 0.996–0.998) but requiring higher computational resources. In contrast, shallow models offered more efficient real-time attack detection, making them suitable for deployment in low-power sensor networks. These findings highlight the trade-off between accuracy and efficiency, reinforcing the need for dynamic model switching in the NGFW to optimize security and performance based on real-time network conditions.

3.2. Adaptive NGFW Algorithm for Securing Sensor Networks

This study developed an adaptive NGFW algorithm that integrates shallow20, deep20, shallow40, and deep40 optimized AI models to secure HTTP, MQTT, and WebSocket services in sensor networks. MQTT facilitates real-time data exchange in smart homes, critical infrastructure, and industrial automation, while HTTP supports web services, RESTful APIs, and cloud applications. WebSocket is essential for real-time sensor data transmission. The NGFW monitors network traffic in real time and dynamically switches between four AI models based on network conditions. In high-traffic, low-resource scenarios, shallow models are prioritized for efficiency, while deep models are activated for higher accuracy. This adaptive selection optimizes detection accuracy while minimizing resource consumption. Benign packets are forwarded, while malicious packets are dropped and logged for continuous training, enhancing security [11]. The model-switching mechanism and classification performance were evaluated using recorded data to assess the algorithm’s effectiveness. Figure 1 illustrates the NGFW architecture securing application servers in sensor networks. The NGFW filters inbound and outbound traffic based on AI model predictions, adapting dynamically to network load and resource constraints. It balances speed and precision by switching between low-latency shallow models and high-accuracy deep models. In conjunction with system firewalls like nftables, it blocks persistent malicious traffic, while dropped packets are stored for adversarial training to enhance model robustness. Additionally, the NGFW functions as a reverse proxy, anonymizing the server by concealing its IP and ports, adding an extra layer of security [25].

3.3. Adaptive NGFW Model Switching

The NGFW switches between deep and shallow AI models based on inference speed. Two runtime strategies were developed and tested: (i) on-demand model loading and (ii) preloaded model switching. Both strategies use shared logic to determine the optimal model based on network load conditions and then switch accordingly. Algorithms 1–6 outline the key steps for each approach. The NGFW algorithm includes six key processes: initialization, preloading, on-demand loading, changing inference speed, model switching, and traffic prediction. Figure 2 illustrates its high-level diagram.

Table 3 describes the algorithms illustrated in Figure 2.

The pseudocode for the key algorithms is given below.

3.4. Performance Analysis

The NGFW algorithm was evaluated under near real-world conditions through simulation on a single CPU with 2 GB of memory, dynamically adapting to varying inference speeds to maintain responsiveness under fluctuating network loads. The evaluation utilized two Python scripts, each implementing two asynchronous processes: one for adjusting inference speed for model switching and the other for inference. The inferencing process tested the 20-feature and 40-feature datasets in batches of 50 samples using dynamically loaded shallow and deep models. Performance metrics [32] including model loading/switching time, memory usage, and inference performance were logged to assess the algorithm’s efficiency and adaptability. This evaluation was aimed at demonstrating that the NGFW effectively balances security, resource efficiency, and real-time adaptability in sensor networks.

4.1. Model Loading Time Analysis

The on-demand model loading approach loaded models 129 times across four inference speeds, 1 to 4, distributed randomly but nearly equally in the NGFW framework. Table 4 shows the count of models loaded and loading time statistics in seconds.

In the loading-on-demand approach, the deep20 and deep40 models demonstrate similar mean values, but the deep40 model exhibits a significantly higher maximum loading time. The shallow20 and shallow40 models exhibited much lower mean values. The deep40 and deep20 recorded a mean loading time of around 0.177 s, while the shallow models’ mean falls around 0.056 s, demonstrating a significant difference. The overall mean loading time of 0.117 s represents the combined performance of the preloading approach, with deep models contributing more due to their complexity.

Figure 3 illustrates the distribution and variability of model loading times in the on-demand model loading approach. The deep models demonstrate higher mean values and greater variability compared to the shallow models, which are more consistent but consume lower resources.

Figure 4 illustrates that shallow models load better in the on-demand approach compared to deep models. They handled more than 60% of the test traffic.

The preloading approach reduced the delay typically associated with on-demand loading. As shown in Table 5, when preloaded, the deep40 model consumed significantly more memory than other models due to its complexity and number of layers. The memory used by shallow20 is negligible. The shallow models were significantly faster. Garbage collection plays a role in optimizing memory usage, but deep models still require substantial memory after cleanup.

While preloaded model switching minimizes latency by keeping all models resident in memory, it incurs a fixed memory cost of approximately 19 MB. This approach is well suited for edge gateways with sufficient resources. In contrast, the on-demand strategy dynamically loads models based on network conditions, resulting in variable memory usage ranging from 0.001 MB (shallow20) to 17.8 MB (deep40). Although this introduces model switching latency, it offers a memory-efficient alternative ideal for low-memory sensor nodes where resource constraints are critical. Hence, the preloaded approach is optimal for performance-critical environments, while the on-demand approach is better for memory-constrained deployments.

Overall, as shown in Table 6, the preloading approach offers a significant advantage over the on-demand approach in model switching during inference. It incurs virtually no delay (0.0 s), ensuring instant transitions. In contrast, the on-demand approach introduces noticeable latency and variability in loading times, leading to performance issues when switching between models. Thus, preloading reduces delays and enhances performance, especially in scenarios requiring frequent model switching. The CPU usage in both approaches was nearly the same, 0.32% in the preloaded approach and 0.33% in the on-demand approach.

4.2. Prediction Time Analysis

As shown in Table 7, the comparison of prediction times for preloaded and on-demand approaches reveals some interesting insights. During on-demand model loading, the deep models exhibited slightly higher mean prediction times and greater variability due to their complexity. In contrast, the shallow models were generally faster, with shallow20 being the most efficient choice for low-resource environments. The preloading approach had a mean prediction time of 0.087624 s, which is marginally lower than the mean prediction time of 0.087694 s for the on-demand loading approach.

The preloaded models demonstrated greater stability with a lower standard deviation, ensuring more consistent prediction times across all models. This makes preloading of models preferable for real-time applications where reliability is crucial. In contrast, on-demand models exhibit higher variability, illustrated in Figure 5. The higher standard deviation and larger maximum values of the on-demand approach indicate occasional performance spikes and potential latency issues.

Figure 6 illustrates the mean variability of prediction times of on-demand and preloading approaches.

Despite their similar mean prediction times, the increased variance in the on-demand approach suggests that, while they perform comparably on average, they may introduce delays in certain cases. As a result, preloaded models are generally more efficient when consistency and predictability are key factors.

4.3. Time Complexity Analysis

The time complexity analysis of the on-demand approach (ngfw_multi_model1.py) and the preloaded approach (ngfw_multi_model2.py) highlights the efficiency gains of preloading models. The preloaded approach is significantly more efficient as it reduces the model switching overhead from O(m) to O(1) by initializing all models at startup. In contrast, the on-demand approach loads models dynamically each time a switch occurs, introducing additional computational overhead. However, both approaches share the same inference complexity of O(n × f × w × l), where n is the number of samples, f is the number of features, w is the number of neurons per layer, and l is the number of layers. Additionally, logging, data preprocessing, and adaptive speed functions remain identical in both implementations, ensuring consistency in data handling. Overall, the preloaded approach is the preferred choice for performance optimization due to its reduced switching overhead and increased efficiency, as shown in Table 8.

Figure 7 illustrates the comparison of time complexities between the on-demand model loading approach and the preloaded model approach. The plot demonstrates that the preloaded approach offers superior performance by reducing the model switching overhead from O(m) to O(1), while maintaining similar inference complexities. This confirms that preloading models is a more efficient strategy for reducing time complexity in real-time applications.

4.4. Classification Metrics

Table 9 summarizes the classification metrics for both on-demand and preloading approaches.

The preloading approach offers a slight performance improvement over on-demand loading, achieving higher accuracy and an improved F1 score, indicating a marginally better balance between precision and recall. Additionally, preloading enhances precision, reducing false positives, while recall remains nearly identical. Furthermore, it eliminates model switching delays (0.0 s), a significant advantage for latency-sensitive applications. Although the overall metrics are similar, these slight improvements and reduced latency make preloading a more attractive option when both performance and speed are priorities. The adaptive model selection strategy optimizes both speed and accuracy based on available resources, making it a versatile solution for various attack detection use cases in sensor networks using an NGFW.

The comparison of intrusion detection techniques across five studies shown in Table 10 reveals key performance advantages of the proposed work, “adaptive NGFW using 4 DL models.” Unlike the others, this work offers a well-rounded performance profile with 96% accuracy, 98% precision, 95% recall, 96% F1 score, and memory use of 19 MB. It outperforms or matches the best metrics across prior studies. For instance, although [21] reports a slightly higher accuracy at 99%, it lacks transparency on precision, recall, and memory usage. Dhakal et al. [22] offer decent performance with federated learning, yet it peaks at 88% recall and lacks full metric coverage. Lee et al. [28] and Kheddar et al. [23] excel in niche areas but either omit key statistics or face scalability concerns in constrained environments. In contrast, this work not only maintains top-tier detection performance but also demonstrates practical deployment readiness with a lightweight 19 MB memory footprint, making it ideal for real-world, resource-sensitive environments. Thus, its balanced excellence across accuracy, efficiency, and transparency justifies it as a superior, production-ready IDS approach.

4.5. Real-World Challenges

Deploying the proposed solution in low-resource environments presents several challenges. The shallow20 model, offering a balance between latency, accuracy, and resource consumption, is preferable where deep models are impractical. NGFWs must efficiently process real-time sensor traffic while minimizing latency spikes that could delay attack detection. AI models remain susceptible to evasion attacks, requiring continuous adversarial training using dropped packets to enhance resilience. Seamless NGFW integration with MQTT, HTTP, and WebSocket protocols across heterogeneous devices is critical for long-term adaptability. Furthermore, edge-based AI deployments must incorporate load balancing to avoid centralized points of failure. Compliance with stringent privacy regulations in healthcare, smart cities, and industrial applications demands privacy-preserving AI techniques. Mitigation measures include applying homomorphic encryption to secure data during AI inference and implementing differential privacy through noise-based anonymization techniques to protect sensitive user data in smart city and healthcare contexts [33].

4.6. Deployment Limitations and Practical Considerations

While the adaptive NGFW has been rigorously validated using high-fidelity simulations and real-time emulation loops, the system has not yet been deployed in live sensor network environments. This represents a limitation in assessing long-term behavior, fault tolerance, and response to unpredictable traffic or node failure. However, the current architecture has been designed to be modular and lightweight enough for near-edge and embedded deployment, and our test scenarios closely mirror operational traffic patterns using the UNSW-NB15 dataset.

4.7. Scalability Considerations

Dynamically switching between low-resource shallow models and high-accuracy deep models based on real-time network conditions allows the adaptive NGFW to optimize performance. However, frequent model switching introduces performance overhead, necessitating caching preloaded models to minimize delays.

As shown in Figure 8, the NGFW system experiences a rise in CPU usage as the model switching frequency increases. While low-frequency switching, less than 5/min, incurs minimal overhead, frequent switching, more than 20/min, leads to a noticeable increase in CPU load. This cumulative computational cost, if left unoptimized, can affect large-scale deployments where hundreds of nodes operate concurrently. This trade-off underscores the need for intelligent switch threshold management and batching logic. Current work focuses on using moving average inference rates and predictive rate-limiting to reduce unnecessary switching while maintaining adaptability, throughput, and resource efficiency at scale. To address this, future work will explore dynamic batching, inference rate throttling, and switch threshold tuning to maintain responsiveness without overburdening the system.

Moreover, a distributed approach using federated learning [33] enhances scalability and resilience. Local attack detection at edge nodes reduces reliance on central servers, mitigating network congestion. Preloading models significantly reduces switching delays, making them ideal for real-time applications. However, this increases memory consumption, requiring careful resource allocation strategies to balance efficiency and performance. Furthermore, the NGFW framework should implement incremental learning to adapt to evolving attack patterns. Federated learning enables AI models to be trained collaboratively across multiple sensor networks, ensuring continuous improvement while preserving data privacy.

Overall, these results confirm the NGFW’s adaptability, maintaining high detection accuracy and efficient real-time traffic classification. By integrating adaptive security mechanisms, the proposed NGFW offers a scalable and robust attack detection solution for modern sensor networks. The optimal choice between on-demand and preloaded switching ultimately depends on resource availability and inference load. In summary, the NGFW leverages adaptive AI models to balance accuracy and response time, optimizing performance based on network conditions.

4.8. Novelty of This Study

This study introduces a novel adaptive AI-driven NGFW specifically designed for securing resource-constrained sensor networks—a domain where current security frameworks remain inadequate. Its key innovation lies in a real-time model-switching mechanism that dynamically selects from four neural networks (two shallow and two deep), enabling intelligent adaptation to varying traffic loads and hardware limitations. This is the first implementation to offer dual runtime strategies: (i) on-demand model loading for memory-constrained deployments and (ii) preloaded model switching for latency-sensitive environments. This flexibility allows seamless operation across diverse infrastructure—from lightweight edge nodes to high-capacity gateways. Validated using the UNSW-NB15 dataset, the system achieves 96% accuracy, 98% precision, and 95% recall, with 4-ms latency and a compact 19-MB memory footprint. These performance metrics, coupled with adaptive deployment strategies, make the system highly effective for real-time protection in IoT, healthcare, smart grid, and industrial automation contexts.

In contrast to existing NGFWs, which rely on static AI models or lack adaptability under fluctuating resource constraints, this work introduces modular model-switching logic, resource-aware optimization, and lightweight implementation, addressing major limitations in the literature. It defines a new benchmark for scalable, responsive, and efficient AI-based firewalls. Moreover, this framework lays the groundwork for future enhancements, including federated learning, adversarial training, and explainable AI (XAI), to improve robustness, transparency, and privacy in distributed environments. As such, it presents a practical and forward-looking solution to the evolving cybersecurity challenges in next-generation sensor networks.

4.9. Future Work

Building on the adaptive NGFW framework introduced in this study, future work will enhance system adaptability, resilience, and deployment efficiency. Advanced shallow–deep hybrid AI architectures will be developed, combining the low-latency response of shallow models with the deep feature extraction capabilities of deep networks to support dynamic traffic conditions and hardware limitations. Continuous learning techniques, including incremental and online learning, will be implemented to allow the NGFW to adapt to evolving threats without full retraining. Federated learning will also be integrated to enable decentralized, privacy-preserving model updates across distributed nodes [22]. Hardware-aware optimizations such as model quantization, pruning, and lightweight inference will ensure efficient operation on resource-constrained devices [34]. Neural processing unit (NPU) integration will be explored to accelerate AI inference while minimizing CPU and memory usage [35]. XAI techniques will be adopted to enhance system transparency, trust, and diagnostic capabilities in critical infrastructure deployments [36].

Initial validation will be conducted on two testbeds: a smart campus sensor network for environmental monitoring and an IoT-enabled agriculture setup, both employing Raspberry Pi–based nodes with Wi-Fi and ZigBee connectivity [37]. To further strengthen security, adversarial defense strategies such as model ensembling and adversarial training will be integrated [38]. RL and continuous policy adaptation mechanisms will also be employed to dynamically update security measures against evolving threats [39].

In addition, AI-powered Zero Trust frameworks will be explored to ensure continuous authentication of sensor nodes before granting network access [40]. AI-driven threat intelligence, leveraging real-time feeds and pattern recognition, will be utilized to detect and mitigate advanced persistent threats (APTs) in resource-constrained environments [41]. Future work will also enable real-time edge-to-cloud synchronization for NGFW models to enhance global threat mitigation [42]. Blockchain integration will be explored to provide tamper-proof security logging and preserve log integrity across decentralized networks [43], further enhancing system adaptability and resilience.

Finally, future NGFW iterations will incorporate privacy-by-design principles—including differential privacy, consent-based logging, and policy-driven model auditing—to ensure compliance with global regulations such as GDPR and HIPAA [6, 44]. These advancements are aimed at facilitating lawful, scalable, and secure AI-driven cybersecurity for next-generation sensor networks. These deployments will evaluate latency, model switching accuracy, and adaptability under varying network constraints. Long-term validation will extend to smart city grids, industrial IoT systems, and healthcare sensor networks to assess scalability and operational robustness.