# A Hybrid STL-Deep Learning Framework for Behavioral-Based Intrusion Detection in IoT Environments
## 4 Algorithm Overview: Hybrid STL-DL Framework
While direct, absolute comparisons are challenging due to variations in methodology and dataset splits, these comparisons highlight the relative strengths of our approach, particularly in minimizing critical detection error rates. Tables 5 and 6. The analysis of Tables 5 and 6 reveals the superiority of the proposed STL + LSTM framework over state-of-the-art methods. The STL + LSTM model, by integrating STL pre-filtering, demonstrates an enhanced ability to correctly identify intrusions while minimizing both false positives and false negatives. The CNN-KPCA method [13] achieved a high level of accuracy and F1-score and the STL + LSTM framework (98.45% and **98.49**%) exceeded the model, with 99.8% for accuracy and 99.5% for F1-score, but our model presents a major enhancement with the high reduction in FNR (0.052) and FPR (0.00276) with respect to the results in the paper. The LSTM [15], with 95.55% accuracy and 96.80% for F1-score, and the TS-IDS model [42], with 93.3% for accuracy and 77.97% for F1-score, both had lower performance with respect to the proposed framework, with our framework presenting a greater enhancement in all metrics. \begin{table}
\begin{tabular}{l c c} \hline \hline
**Framework** & **Accuracy** & **F1-Score** \\ \hline CNN-KPCA [13] & 99.8\% & 99.5\% \\ \hline Proposed Framework (STL + LSTM) & 98.45\% & **98.49\%** \\ \hline LSTM [15] & 95.55\% & 96.80\% \\ \hline TS-IDS [42] & 93.3\% & 77.97\% \\ \hline \hline \end{tabular}
\end{table} 
Table 5: Comparison between accuracy and F1-score for various IDS frameworks. The experimental results shown in Tables 5 and 6 indicate that the STL-Deep Learning framework is superior to the methods provided in other papers. For instance, the STL-LSTM presented an FNR of 0.052, which is a great improvement from the method of the paper [9], which lacks these results. The work also shows that the accuracy of the STL-Deep Learning framework is near the values shown in the paper [10,15]. ### Discussion

This section synthesizes the findings and emphasizes the framework's ability to manage trade-offs. The experimental results provide compelling evidence that integrating STL decomposition with deep learning significantly improves IoT intrusion detection. The proposed hybrid STL-LSTM framework achieved excellent overall accuracy, and, crucially, a drastically reduced FNR (5.2%) and FPR (0.276%), demonstrating the superior performance over standalone DL models. A more detailed analysis of the error rates per class shown in Figures 5 and 6 reveals that while the STL + LSTM framework achieves significantly lower FNR and FPR compared to standalone models, the challenge of detecting minority classes persists. For example, Figure 6 shows that despite the overall FNR reduction, the FNR for the Data Theft class remains high (0.70), indicating that 70% of Data Theft instances were missed. Conversely, Figure 5 shows that FPRs are generally low, but for dominant attack classes like DDoS and DoS, even a small percentage translates to a significant number of false alarms in a large dataset. The framework's strength lies in balancing these trade-offs, achieving low FNR for critical high-volume attacks while maintaining relatively low FPR, though detecting rare anomalies like Data Theft effectively remains an area for improvement. The STL pre-filtering effectively simplified the DL classification task, allowing the LSTM network to focus on the most salient anomalies. The results show an excellent balance between the performance and low error rates. The high-performance STL-LSTM framework is suitable to be used to provide real-time security and protect any organization infrastructure. While the total execution times shown in Figure 7 for processing the entire large test dataset are significant, this represents bulk processing time. The real-time applicability depends on the per-packet inference latency of the DL model, which, operating on potentially feature-reduced data, can be optimized for lower latency.