# A Hybrid STL-Deep Learning Framework for Behavioral-Based Intrusion Detection in IoT Environments
## 4 Algorithm Overview: Hybrid STL-DL Framework
\[\text{FPR}=\frac{FP}{FP+TN}\]
* FNR: measures the proportion of actual attacks that were incorrectly classified as Normal traffic. This represents missed detections and is a critical metric for security. \[\text{FNR}=\frac{FN}{TP+FN}\]
* Confusion Matrix: This matrix provides a detailed breakdown of the classification results, showing the number of true positives, true negatives, false positives, and false negatives for each class. * Execution Time (Prediction Time): the time required to classify a single network packet. It also measures the total time it takes for the model to classify a whole testing set. ## 6 Results and Discussion

This section presents and discusses the experimental results obtained from the evaluation of our proposed hybrid STL-Deep Learning IDS framework. The discussion is organized to directly address the research questions outlined in the Introduction (Section 1) and provides a comprehensive assessment of the framework's performance. Addressing RQ1: How Effectively Can STL Pre-Filtering Separate Normal, Predictable IoT Network Traffic Patterns from Potentially Anomalous Traffic Based on Time Series Decomposition? To address RQ1, we first examined the performance of the STL pre-filtering module. The primary goal of STL was to isolate normal traffic from the traffic flows, with the aim of simplifying the classification task for the DL models, and identifying a more appropriate threshold to filter the traffic flows, thus enhancing the detection accuracy. The parameter tuning process identified the \"Transaction State\" feature as the most effective for decomposition, meaning that it captures the features that allow better distinction between Normal and Attack classes, hence allowing a better separation. A threshold value of 0.284 was determined for the STL remainder. This value was selected based on the confusion matrices in the tuning process, where it resulted in maximizing the true negative rate while minimizing the false negative rate for normal traffic classification. To illustrate the capabilities of the STL pre-filtering, we present the confusion matrix generated from STL's standalone classification in Figure 3. The confusion matrix is shown below. Analyzing the confusion matrix (Figure 3), which illustrates the standalone performance of the STL thresholding step when applied directly to the highly imbalanced dataset context, reveals the inherent challenges of this simpler approach. While the overall accuracy might appear deceptively high due to the overwhelming number of correctly classified majority attack instances (true positives for attacks), this metric masks critical weaknesses. The matrix highlights significant limitations for standalone use. Firstly, analyzing the \"Normal\" row in Figure 2 shows 2100 instances were correctly classified (TN), but a substantial 3,299,550 'Normal' instances were misclassified as Attack (FP), resulting in an extremely high false positive rate (FPR) for normal traffic when using STL alone. Secondly, and critically for security, the \"Attacks\" row shows a very large absolute number of actual attacks (approximately 19 million total) where 900 were misclassified as 'Normal' (FN),

Figure 3: Confusion. Matrix for the STL algorithm (standalone performance). This shows the classification results before deep learning. The data are separated into Attack and Normal classes. indicating a significant number of missed attacks, leading to a high false negative rate (FNR). These findings underscore the severe limitations of using STL thresholding as a standalone classifier in realistic, imbalanced network environments. It demonstrates the clear necessity for a more sophisticated classification stage, such as that of the deep learning models employed in the proposed STL + DL method, to effectively handle the complexity, distinguish subtle anomalies, and achieve the low error rates crucial for reliable intrusion detection.