# A Hybrid STL-Deep Learning Framework for Behavioral-Based Intrusion Detection in IoT Environments
## 4 Algorithm Overview: Hybrid STL-DL Framework
* \(f_{\text{DL}}(z^{\prime};\bigcirc)\): function representing the forward pass of the deep learning model \(\bigcirc\) on input \(z^{\prime}\), outputting class probabilities. * \(P(y=c\mid z^{\prime})\): probability that instance \(z^{\prime}\) belongs to class \(c\). This algorithm outlines the proposed hybrid approach for detecting IoT intrusions. First, incoming network data undergo preprocessing and scaling. The core novelty lies in using STL to analyze specific traffic time series, identifying the predictable trend and seasonal components, and isolating the unpredictable'remainder'. Instances corresponding to large remainder values, indicating significant deviation from normal patterns, are selected for further scrutiny. PCA then reduces the dimensionality of the features associated with these selected instances. Finally, these reduced, standardized features representing potentially anomalous traffic are classified by a pre-trained deep learning model such as LSTM to determine if they constitute normal activity or a specific attack type. This targeted approach allows the sophisticated DL model to focus on classifying genuinely suspicious patterns, enhancing overall detection performance. ### Data Preprocessing

Data preprocessing is a crucial step in preparing the raw network traffic data for effective analysis by the subsequent modules. * Initial Feature Handling: The initial preprocessing stage addresses data quality and prepares the features for subsequent analysis. Specifically, this involves the following steps:
* Null Value Removal: removing any features containing missing or null values. * Encoding Categorical Features: converting non-numerical features such as protocol types into numerical representations using techniques like one-hot encoding. * Feature Selection (Initial Filtering): Before normalization and other steps, a basic feature selection/filtering step can be incorporated at this stage, which, although not explicitly discussed, can be considered a first-pass approach. * Normalization Strategy: Two-stage normalization strategy was employed, in order to improve both the performance of STL and of DL models. * Min-Max Scaling (Pre-STL): Prior to STL decomposition, min-max scaling was applied to the original feature values. This ensures that data used in the STL decomposition are bounded within a specific range (0,1). The rationale is that STL, a statistical method, can function more effectively with non-negative, bounded data, improving decomposition performance and reducing sensitivity to extreme values [10]. * Standard Scaling (Post-STL): Following STL decomposition and (optionally) after filtering the remainder data (or after PCA in other flows), standard scaling
(Z-score normalization) was applied to the data before feeding them to the deep learning models. This ensures each feature has a mean of 0 and a standard deviation of 1. This is standard practice in deep learning; it helps prevent features with large ranges from dominating the learning process and can improve the convergence speed and stability of the neural networks, as these models generally operate best with normally distributed data. * Dimensionality Reduction (PCA): PCA helps reduce the computational load and model complexity, a process to be discussed below. ### STL Decomposition Module

The core of our hybrid approach lies in the application of STL to the network traffic data. STL, or seasonal-trend decomposition using Loess [10; 31], is a robust and versatile method for decomposing a time series into three components: seasonality, referring to recurring patterns that occur over fixed time intervals such as daily or weekly trends; trend, which captures the underlying long-term direction of the time series; and remainder, which represents the residual component, including noise, outliers, and deviations from both the seasonal and trend components.