# A Hybrid STL-Deep Learning Framework for Behavioral-Based Intrusion Detection in IoT Environments
## 4 Algorithm Overview: Hybrid STL-DL Framework
The STL + LSTM model generally maintains the lowest FPR among the configurations. * Figure 6 (FNR) displays the proportion of actual attacks or normal instances that were missed (misclassified). The simulation highlights a critical challenge: While the FNR for dominant attacks such as STL + LSTM FNR for DoS is **0.04**, it increases substantially for minority classes. The FNR for normal traffic with STL + LSTM is **0.25**, and it is dramatically high for Data Theft at **0.70**, indicating that most instances of this rare attack are missed in the imbalanced setting. Again, STL + LSTM tends to achieve the lowest FNR compared to other models, although the challenge with extreme minority classes persists. * **Execution Time (Figure 7):*
* This figure illustrates the computational time required for each model configuration to classify the test dataset. Figure 7 illustrates the total execution time required for each model configuration to classify the entire test dataset, which comprises a massive 22 million samples. These reported times, ranging from approximately 3100 to 3600 s, represent the time for processing this large volume in a batch manner, not the per-packet latency required for real-time detection. A slight overhead is observed for the hybrid STL-based models such STL + LSTM at **3500 s*
* compared to their standalone counterparts LSTM at **3200 s**, attributable to the initial STL processing step. Figure 4: F1-score by model. Figure 5: FPR by model. Figure 6: FNR by model. Also, the STL + LSTM has the best performance in the classification metrics, such as the F1-score, and it has a low number of false alarms. The STL + LSTM model confusion matrix is presented in Figure 8.

The STL + LSTM model presents near-perfect results in most of the classes. These findings highlight the strength of the proposed STL pre-filtering in simplifying the classifi

Figure 8: Confusion matrix for the STL + LSTM algorithm. Figure 7: Execution times using different experimental frameworks. cation. Analyzing the STL + LSTM confusion matrix shown in Figure 8 in detail provides further insight. For dominant classes like DDoS and DoS, the diagonal values representing true positives (TP) are very high, while false positives (FP) and false negatives (FN) for these classes are relatively low within this matrix visualization, aligning with the high F1-scores and low error rates reported in Table 4 and Figures 5 and 6. However, the matrix also visually demonstrates the challenges with minority classes. For example, while the number of Normal instances misclassified as Attacks (FP) is low (930), the number of Normal instances missed (FN, which would appear in the Normal row if predictions were shown) contributes to the FNR reported in Table 5 (0.25). Similarly, the low TP count for Data Theft instances within this matrix confirms the difficulty in detecting this rare class, consistent with the high FNR (0.70) shown in Table 5. These detailed matrix breakdowns support the FNR/FPR observations and underscore the trade-offs involved in detecting both common and rare events in imbalanced data. ### Addressing RQ5: How Did the STL Module Affect the DL Models? The key results of the STL pre-filtering method show that there is a great advantage in applying it, as shown in Table 5 and the confusion matrices in Figure 8. The reduction in FNR and FPR across all the models indicates that the STL pre-filtering streamlined the classification process for the DL models, enabling them to focus on the most salient anomalies. Addressing RQ4: How Does the Performance of the Proposed STL-DL Framework Compare to Existing State-of-the-Art IDS Solutions Evaluated on Similar IoT Datasets? To address RQ4, we provide a comparison of our STL-Deep Learning framework with existing state-of-the-art IDS solutions from the literature. This assessment, shown in Tables 5 and 6, is based on results reported by other researchers using the IoT-IoT dataset or similar large-scale IoT IDS benchmarks, allowing for a relative evaluation of performance.