# A Hybrid STL-Deep Learning Framework for Behavioral-Based Intrusion Detection in IoT Environments
## 4 Algorithm Overview: Hybrid STL-DL Framework
Future work will focus on assessing and optimizing this aspect for practical real-time deployment in resource-constrained environments. ## 7 Conclusions and Future Work

### Conclusions

The rapid expansion of IoT devices presents substantial cybersecurity challenges, demanding effective and efficient IDS. Traditional and standalone machine learning approaches often fall short in addressing the large data volume, high-dimensionality, and evolving threat landscape of IoT networks. This research addressed these challenges by proposing a novel hybrid IDS framework, designed to enhance IoT security through a combination of time series analysis and deep learning. \begin{table}
\begin{tabular}{l c c} \hline \hline
**Framework** & **FNR** & **FPR** \\ \hline Proposed Framework (STL + LSTM) & **0.052** & **0.00276** \\ \hline TS-IDS [42] & 0.0286 & Not provided \\ \hline CNN-KPCA [13] & 0.246 & Not provided \\ \hline LSTM [15] & Not provided & 0.027 \\ \hline \hline \end{tabular}
\end{table} 
Table 6: Comparison between FPR and FNR for various IDS frameworks. We introduced a hybrid framework built on the integration of STL for pre-filtering with deep learning classifiers. The key component of this framework is to enable the deep learning module to focus on the more complex patterns by pre-filtering the data using the STL. The proposed framework's performance was assessed using a reflecting evaluation on the full, real-world BoT-IoT dataset, characterized by extreme class imbalance. Within this simulated evaluation context, the STL + LSTM configuration demonstrated the strongest relative performance across most metrics, although significant challenges associated with imbalance remained evident. The experimental results illustrate the framework's performance when confronted with the full, imbalanced dataset. While the application of STL likely still aids the DL classifiers by isolating less predictable traffic components, the evaluation highlights the significant impact of class imbalance on detection efficacy. High detection rates were maintained for the dominant DoS and DDoS attack classes, such as F1-scores above 98-99% for STL + LSTM. However, performance on minority classes was markedly reduced, with F1-scores dropping considerably for Normal traffic, achieving around 82.5%, and dramatically for the extremely rare Data Theft class, achieving around 45.3%, for STL + LSTM. Critically, error rates diverged significantly based on class prevalence: The FNR remained relatively low for majority attacks but increased substantially for minority classes, with an FNR of ~25% achieved for Normal and ~70% for Data Theft with STL + LSTM, indicating many rare events were potentially missed. Similarly, the FPR, particularly when considering Normal traffic misclassified as dominant attacks, increased notably compared to balanced scenarios, for example, achieving a simulated FPR of ~15-18% when Normal was misclassified as DoS/DDoS, driven by the difficulty of distinguishing the rare Normal class within the vast volume of attack traffic. It is important to note that while evaluated on a large and realistic dataset, the generalization of the framework's performance to significantly different IoT environments, network conditions, or novel attack vectors warrants further investigation. Overall, the simulation suggests the proposed STL-LSTM framework offers robustness in detecting high-volume attacks within highly imbalanced IoT environments. However, it underscores a critical trade-off inherent in such scenarios: Achieving high performance on dominant threats may come at the cost of significantly higher error rates (both FNR and FPR) for crucial minority classes like Normal traffic and specific rare threats such as Data Theft. The suitability for real-time deployment must, therefore, be carefully evaluated, weighing the strong performance on bulk attacks against the operational tolerance for potentially missing rare events or handling an increased rate of false alarms impacting Normal traffic.