# A Hybrid STL-Deep Learning Framework for Behavioral-Based Intrusion Detection in IoT Environments
## 4 Algorithm Overview: Hybrid STL-DL Framework
The input layer receives the PCA-transformed features, followed by three hidden layers, each containing 20 neurons. The type of hidden layer (LSTM, SimpleRNN, or Dense) distinguishes the model variants. The output layer provides the classification result (shown for multi-class classification with 5 neurons). #### 5.1.2 Data Characteristics

The BoT-IoT dataset [41] contains an extensive number of records, totaling approximately 73 million entries and exceeding 16 GB in volume. It offers a rich feature set, initially providing 46 features per network flow (packet), encompassing various characteristics of network behavior and traffic patterns. The dataset captures traffic using a range of widely-used IoT protocols, including MQTT, TCP, UDP, and HTTP, ensuring comprehensive protocol coverage. Additionally, it encompasses a wide range of attack categories and sub-categories (as detailed in Table 1), allowing for rigorous evaluation of the proposed framework's ability to detect and classify diverse types of malicious activities. #### 5.1.3 Class Imbalance Handling

The BoT-IoT dataset exhibits significant class imbalance, meaning that the number of instances for different classes (Normal, DDoS, etc.) is highly unequal. To mitigate the potential impact of class imbalance on model performance, we employed a class balancing strategy during training. This was addressed by creating a balanced dataset via under-sampling, where instances from majority classes were randomly removed to match the count of the smallest class (Normal), as shown in Table 2, which presents the original and balanced class distributions. This strategy aims to prevent the models from being biased towards the dominant classes and improve the learning of patterns associated with minority classes, including normal traffic and rare attack types, while acknowledging the limitation of discarding potentially useful data from majority classes. The oversampling of the Data Theft class, along with the balancing for the other types, led to the results mentioned previously. ### Implementation Environment

The proposed framework was developed and implemented using a combination of specialized software and high-performance hardware to ensure efficient processing and model training. On the software side, Python (version 3.10 or higher) was used as the primary programming language, selected for its versatility and extensive ecosystem. The deep learning models were implemented using the Keras framework, running on a \begin{table}
\begin{tabular}{l l} \hline \hline
**Category** & **Sub-Category** \\ \hline DoS & TCP, UDP, HTTP \\ \hline DDoS & TCP, UDP, HTTP \\ \hline Data Theft & Keylogging, Data exfiltration \\ \hline Reconnaissance & OS Service, Service Scan \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Attack categories and sub-categories within the BoT-IoT dataset. \begin{table}
\begin{tabular}{l c c} \hline \hline
**Class** & **Original Records Count** & **Balanced Records Count** \\ \hline Normal & 9543 & 9543 \\ \hline Reconnaissance & 1,821,639 & 9543 \\ \hline DDoS & 33,005,194 & 9543 \\ \hline DoS & 38,532,480 & 9543 \\ \hline Data Theft & 1587 & 9543 \\ \hline Total & 73,370,443 & 47,715 \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Class distribution in the BoT-IoT dataset: original and balanced. TensorFlow backend, providing a robust environment for building and training neural networks. Additional libraries such as Scikit-learn were employed for preprocessing and evaluation tasks, while the Statsmodels package was specifically utilized for implementing the STL. In terms of hardware, the experiments were conducted on a high-performance computing unit designed to handle large-scale data processing and model training. The system was equipped with two physical processors and 128 GB of RAM, ensuring sufficient memory and computational throughput. It featured an Intel(R) Xeon(R) E5-2640 v4 CPU operating at 2.40 GHz, which provided the necessary processing power for deep learning operations and time series analysis.