# A Hybrid STL-Deep Learning Framework for Behavioral-Based Intrusion Detection in IoT Environments
## 4 Algorithm Overview: Hybrid STL-DL Framework
This setup facilitated the efficient execution of the proposed framework and supported rigorous experimentation with various model configurations. ### Model Training

The deep learning models (LSTM, SimpleRNN, and DNN) were trained using a carefully structured configuration. The balanced dataset (as detailed in Table 2) was divided into three subsets: 54% of the data were allocated to the training set for model learning, 16% to the validation set for hyperparameter tuning and early stopping, and the remaining 30% to the testing set to evaluate the final model performance. Several important hyperparameters were tuned to optimize the training process. The Adam optimizer was selected for its adaptive learning capabilities, with a learning rate set to 0.0001. The models were trained using a batch size of 1000, and the number of epochs ranged from 40 to 100, depending on the early stopping criteria. The choice of loss function depended on the classification task: categorical cross-entropy was used for multi-class classification, while binary cross-entropy was applied for binary classification. To mitigate the risk of overfitting, early stopping was employed based on the validation loss. This mechanism continuously monitored the performance on the validation set and terminated training if no improvement was observed over a defined number of epochs, ensuring a more generalized and stable model. Several important hyperparameters were tuned to optimize the training process. The Adam optimizer was selected for its adaptive learning capabilities, with an initial learning rate set to 0.0001; experiments exploring rates in the range [0.0001, 0.001] showed 0.0001 provided the best convergence without excessive oscillation. The models were trained using a batch size of 1000, chosen to balance memory constraints and gradient stability. The number of epochs ranged from 40 to 100, depending on the early stopping criteria, allowing sufficient time for convergence. The choice of loss function depended on the classification task: categorical cross-entropy was used for multi-class classification (Normal, DoS, DDoS, Data Theft, and Reconnaissance), while binary cross-entropy was applied for binary classification (Attack vs. Normal). To mitigate the risk of overfitting, early stopping was employed based on the validation loss, terminating training if no improvement was observed over a defined number of epochs, ensuring a more generalized and stable model. Grid search and manual tuning based on validation set performance were used to explore these parameters, focusing on maximizing F1-score and minimizing validation loss. ### Evaluation Metrics

To comprehensively evaluate the performance of our proposed framework, we used a variety of established evaluation metrics. These metrics are crucial for assessing the effectiveness of IDS in terms of accuracy, precision, and, crucially, error rates. * Accuracy: measures the overall proportion of correctly classified instances (both Normal and Attack traffic). \[\text{Accuracy}=\frac{TP+TN}{TP+TN+FP+FN}\] where:
* _TP_: true positives (correctly classified as Attack). * TN: true negatives (correctly classified as Normal). * FP: false positives (incorrectly classified as Attack--false alarms). * FN: false negatives (incorrectly classified as Normal--missed attacks). * Precision: measures the proportion of correctly identified attacks out of all instances classified as attacks. \[\text{Precision}=\frac{TP}{TP+FP}\]
* Recall (Sensitivity/True Positive Rate \(-\) TPR): measures the proportion of actual attacks that were correctly identified. \[\text{Recall}=\frac{TP}{TP+FN}\]
* F1-Score: provides a balanced measure of a model's accuracy, representing the harmonic mean of precision and recall. \[\text{F1-score}=2\times\frac{\text{Precision}\times\text{Recall}}{\text{ Precision}+\text{Recall}}\]
* FPR: measures the proportion of normal traffic that was incorrectly classified as Attack. This is critical for minimizing false alarms.