The proliferation of Internet of Things (IoT) devices in smart homes has brought about unparalleled convenience and control in everyday living. Nevertheless, these devices also pose considerable security challenges, especially in anomaly detection, due to their constant data production and diverse characteristics. While conventional network defense mechanisms are highly effective in traditional computing environments, they often prove ineffective for IoT hardware due to limited computational resources. This paper introduces a self-adaptive intrusion detection system (IDS) based on a hybrid Edge–Cloud architecture designed to address two critical challenges: real-time threat detection at the smart-home gateway and continuous model enhancement in the cloud. At the gateway, a LightGBM model deployed on a Raspberry Pi performs binary classification, achieving an average detection delay of only around 8.4 ms. When an anomaly is detected, the anomalous traffic is forwarded to the Cloud layer, where a CNN–LSTM model conducts incremental learning and distills its knowledge into an optimized edge model. This updated model is automatically containerized and redeployed back to the edge, enabling a fully self-evolving defense loop. Experimental results conducted on the raw CIC-IDS2017 dataset, after undergoing a customized preprocessing and validation pipeline to ensure applicability in real-world deployment. The system achieves 96.94% accuracy and 97.01% F1-score while maintaining a modest resource footprint around 25–30% CPU and 300–400 MB RAM. The proposed framework provides a practical, lightweight, and adaptive security solution tailored for modern smart-home environments.