# A Hybrid STL-Deep Learning Framework for Behavioral-Based Intrusion Detection in IoT Environments
## 4 Algorithm Overview: Hybrid STL-DL Framework
Furthermore, the substantially longer execution times required to process the full dataset, ~3500 s for STL + LSTM, present additional practical considerations for real-time application in resource-constrained IoT environments. ### Future Work

Building on the successes of this research, several promising directions are identi- fied for future work. First, rigorous evaluation on a wider range of diverse IoT datasets such as CSE-CIC-IDS2018 and IoT-Kaggle, varying in network environments, device types, traffic characteristics, and attack vectors, is necessary to thoroughly assess the framework's generalizability and robustness beyond the BoT-IoT dataset. Second, investigating advanced and adaptive STL parameter tuning strategies, such as developing mechanisms to dynamically adjust window sizes and polynomial degrees based on real-time network traffic characteristics or anomaly feedback, could potentially enhance both the accuracy and efficiency of the pre-filtering stage. Third, the exploration of alternative deep learning architectures, including transformers for improved temporal pattern capture over longer sequences and graph neural networks (GNNs) for modeling the relational aspects of network traffic, merits investigation to potentially enhance the detection of more complex and coordinated attacks. Fourth, implementing mechanisms for incremental or online learning within the framework would be crucial for real-time adaptation to evolving threats and network dynamics without requiring periodic retraining on massive historical datasets. This could involve techniques like stochastic gradient descent or model updates based on new anomalous patterns identified. Lastly, conducting focused performance evaluations and developing protocol-specific optimizations for common IoT protocols such as MQTT and CoAP could lead to specialized framework variants better tailored to the unique characteristics and vulnerabilities of traffic leveraging these protocols. Methodology, A.A.; Validation, A.A.; Formal analysis, A.A.; Writing--original draft, A.A.; Supervision, J.A.-M. All authors have read and agreed to the published version of the manuscript. This research received no external funding. Not applicable. The experimental code and data preprocessing scripts supporting the findings of this study are currently available upon request and will be publicly released upon the acceptance of this manuscript. A private repository containing the full implementation and instructions can be accessed at the following confidential link: [[https://drive.google.com/file/d/1Z13](https://drive.google.com/file/d/1Z13) zOPmC1 eRWB3 JlkmRPO6T6 ltl97 FnIM/view?usp=sharing]([https://drive.google.com/file/d/1Z13](https://drive.google.com/file/d/1Z13) zOPmC1 eRWB3 JlkmRPO6T6 ltl97 FnIM/view?usp=sharing) (accessed on 1 May 2025). Upon acceptance, this repository will be made publicly available to support transparency, reproducibility, and further research. The authors declare no conflicts of interest. ## References

* [PERSON] (2018) [PERSON] A Reliable Communication Framework and its Use in Internet of Things (IoT). _CSEIT_**2018**, \(3\), 450-456. * [PERSON] et al. (2021) [PERSON]; [PERSON]; [PERSON] Internet of Things: A General Overview between Architectures, Protocols and Applications. _Information_**2021**, _12_, 87. [CrossRef]
* [PERSON] and [PERSON] (2019) [PERSON]; [PERSON]; [PERSON] Intrusion Detection for IoT Based on Improved Genetic Algorithm and Deep Belief Network. _IEEE Access_**2019**, \(7\), 31711-31722. [CrossRef]
* [PERSON] et al. (2018) [PERSON]; [PERSON]; [PERSON] [PERSON]; [PERSON]; [PERSON] A Survey of IoT-Enabled Cyberattacks: Assessing Attack Paths to Critical Infrastructures and Services. _IEEE Commun. Surv. Tutorials_**2018**, _20_, 3453-3495. [CrossRef]
* [PERSON] et al. (2019) [PERSON]; [PERSON]; [PERSON]; [PERSON] Intrusion detection systems in the Internet of things: A comprehensive investigation. _Comput. Netw._**2019**, _160_, 165-191. [CrossRef]
* [PERSON] et al.