Hybrid Deep Learning Behavioral Detection of MITM, Spoofing, and Flooding Attacks in IoT Networks.

Abstract

Current IoT intrusion detection research has shown very high performance on crafted datasets, but its practical usefulness is constrained by three unresolved data issues: highly skewed class distribution, overlapping profiles of similar attack patterns, and lack of convincing evidence that synthetic sample augmentation is able to capture realistic traffic patterns. This paper proposes a multi-class behavioral IoT attack detection framework for 18 categories of attacks to overcome these problems. Our framework adopts a consistent preprocessing procedure on real flow-based traffic and experiments with four deep models and a hybrid model under the same circumstances. The highest performance is achieved when CNN layers are used to learn local traffic patterns and temporal information is encoded using LSTM-based representations; the learned deep representations are then fed to a Random Forest classifier for multi-class classification. To ensure fair evaluation, we first divide the real traffic into training and test subsets, and apply CTGAN to the training set only. This protocol allows for two well-controlled experiments: original imbalanced dataset, and after adding proportionally generated synthetic samples. In this work, we use a dataset of 220,000 real IoT traffic samples, and generate 220,000 synthetic samples used exclusively for expanding the training set. The hybrid CNN-RF/LSTM architecture exhibits the best overall performance (98.71% accuracy, 98.62% Macro-F1 over 18 attack classes), compared to CNN-LSTM, Transformer-BiLSTM, CNN-Transformer and Tab Transformer using the same protocol. Based on comparative ROC curves, precision-recall curves, confusion matrices and latent space visualization, the hybrid design enhances class reparability and alleviates confusion between behaviorally similar attacks. These findings demonstrate the benefit of controlled synthetic augmentation, when confined to the training partition, and combined with deep feature extraction and ensemble classification, in boosting robustness but not in changing the distribution of the original traffic.