# A Hybrid STL-Deep Learning Framework for Behavioral-Based Intrusion Detection in IoT Environments
## 4 Algorithm Overview: Hybrid STL-DL Framework  
The core logic of the proposed framework can be summarized as follows (Algorithm 1):  
```
0: Raw IoT network traffic features \(\mathbf{X}_{raw}\)
0: Classification label \(\hat{y}_{i}\in\{\text{Normal},\text{Attacks}...\}\) for each instance \(i\) flagged by STL
1: Preprocessing:
2:\(\mathbf{X}_{proc}\leftarrow\text{HandleMissingValues}(\mathbf{X}_{raw})\)
3:\(\mathbf{X}_{proc}\leftarrow\text{EncodeCategorical}(\mathbf{X}_{proc})\)
4: Select relevant time-series features \(\mathbf{X}_{ts}\) from \(\mathbf{X}_{proc}\)
5: Normalization (Pre-STL):
6:\(\mathbf{X}^{\prime}_{ts}\leftarrow\text{MinMaxScaler}(\mathbf{X}_{ts})\)\(\triangleright\) Scale features to \([0,1]\)
7: STL Decomposition and Filtering:
8: Select target feature time series \(Y_{t}\) from \(\mathbf{X}^{\prime}_{ts}\) such as scaled \"Transaction State\"
9:\((T_{t},S_{t},R_{t})\leftarrow\text{STL\_Decompose}(Y_{t})\)\(\triangleright\) Get Trend, Seasonality, Remainder
10:\(\mathcal{I}_{amont}\leftarrow\{i\mid|R_{t(j)}|>\theta\}\)\(\triangleright\) Identify indices of instances exceeding remainder threshold \(\theta\)
11:\(\mathbf{X}_{fill}\leftarrow\text{SelectFeatures}(\mathbf{X}_{proc},\mathcal{I}_{amont})\)\(\triangleright\) Select corresponding features for anomalous instances
12: Dimensionality Reduction:
13:\(\mathbf{W}\leftarrow\text{PCA\_Fit}(\mathbf{X}_{fill},k)\)\(\triangleright\) Compute PCA projection matrix for \(k\) components
14:\(\mathbf{Z}\leftarrow(\mathbf{X}_{fill}-\mathbf{\mu}_{fill})\)\(\triangleright\) Project filtered data to \(k\) dimensions
15: Normalization (Pre-DL):
16:\(\mathbf{Z}^{\prime\prime}\leftarrow\text{StandardScaler}(\mathbf{Z})\)\(\triangleright\) Apply Z-score normalization
17: Deep Learning Classification:
18:\(\Theta\leftarrow\text{LoadTrainedModel}(\text{such as LSTM})\)\(\triangleright\) Load pre-trained DL model parameters
19:for each feature vector \(\mathbf{z}^{\prime\prime}_{i}\) in \(\mathbf{Z}^{\prime\prime}\)do
20:\(P(y|\mathbf{z}^{\prime\prime}_{i};\Theta)\gets f_{\text{DL}}(\mathbf{z} ^{\prime\prime}_{i};\Theta)\)\(\triangleright\) Get class probabilities from DL model
21:\(\hat{y}_{i}\leftarrow\arg\max_{c}P(y=c|\mathbf{z}^{\prime\prime}_{i};\Theta)\)\(\triangleright\) Assign class with highest probability
22:return Predicted labels \(\hat{Y}=\{\hat{y}_{i}\}\) for instances in \(\mathcal{I}_{amont}\)
```  
**Algorithm 1** Hybrid STL-Deep Learning IDS Framework  
Variables Used in Algorithm 1  
```
0:\(\mathbf{X}_{\mathbf{raw}}\): raw input network traffic features. 0:\(\hat{y}_{i}\): predicted classification label, for instance, \(i\). 0:\(\mathbf{X}_{\mathbf{proc}}\): preprocessed features after handling missing values and encoding categorical features. 0:\(\mathbf{X}_{\mathbf{ts}}\): subset of \(X_{\text{proc}}\) containing features chosen for time series analysis. 0:\(\mathbf{X}^{\prime}_{\mathbf{ts}}\): \(X_{\text{ts}}\) after min-max scaling. Figure 1: Overview of the proposed hybrid STL-Deep Learning intrusion detection framework. * \(Y_{t}\): target feature time series (e.g., scaled \"Transaction State\") for STL decomposition. * \(T_{t}\), \(S_{t}\), \(R_{t}\): trend, seasonal, and remainder components from STL decomposition of \(Y_{t}\). * \(I_{\text{anom}}\): set of indices of instances flagged as potentially anomalous based on the remainder component \(R_{t}\). * \(\theta\): threshold value applied to the remainder component \(R_{t}\) to identify potentially anomalous instances. * \(X_{\text{fill}}\): features corresponding to the instances in \(I_{\text{anom}}\), selected from \(X_{\text{proc}}\). * \(W\): PCA projection matrix. * \(Z\): feature-reduced representation of \(X_{\text{fill}}\) after PCA projection. * \(\mu_{\text{fill}}\): mean vector of \(X_{\text{fill}}\). * \(Z^{\prime\prime}\): \(Z\) after standard scaling. * \(\bigcirc\): pre-trained deep learning model (LSTM, RNN, or DNN).