# A Hybrid STL-Deep Learning Framework for Behavioral-Based Intrusion Detection in IoT Environments
## 4 Algorithm Overview: Hybrid STL-DL Framework
Therefore, while STL pre-filtering provides an initial separation, further analysis by the DL component is essential to minimize both false alarms and missed attacks. ### Addressing Feature Selection Performance: Does Feature Selection Affect the Performance? Feature selection is a vital component of the performance of deep learning algorithms. The goal of the feature selection stage was to reduce the dimensionality of the feature space, further simplifying the classification task and increasing the computation performance. The study investigated different techniques for feature selection and chose the best one for the algorithm. The analysis of the feature selection results, as shown in Table 3, exhibits that different feature selection techniques affect the performance across all of the five classes. Specifically, Table 3 compares the F1-scores achieved when using features selected by XGBoost importance, PCA, and CHI2, each combined with either min-max or standard scaling, for the classification task using the STL + LSTM model. The results clearly indicate that using features selected and transformed by PCA (both min-max and standard scaled versions) generally resulted in the highest F1-scores across the majority of Attack and Normal classes compared to features selected by XGBoost or CHI2. This suggests that PCA's ability to capture the most significant variance and underlying patterns in the feature space, while reducing dimensionality and potential noise, was particularly effective for this dataset and classification task. Based on these comparative F1-score results, PCA was selected as the most effective feature selection method for the proposed hybrid framework, demonstrating an effective balance between dimensionality reduction and retaining information crucial for classification performance. In Table 4, the STL + LSTM model achieves the overall best results for accuracy and F1-Score across all classes. Notably, the integration of STL pre-filtering led to significant improvements in the model's ability to accurately classify various attack categories, especially with respect to error rates. * **F1-score (Figure 4):** This figure presents a comparison of the F1-scores achieved by each model configuration across the five different traffic classes. As observed in the simulation, models generally maintain high F1-scores for the dominant attack classes such as STL + LSTM achieving **99.1%** for DDoS and **98.0%** for DoS). However, performance degrades significantly for minority classes due to the extreme class imbalance. For instance, the F1-score for the STL + LSTM model drops to **92.0%** for Reconnaissance, **82.5%** for Normal traffic, and only **45.3%** for the extremely rare Data Theft class, highlighting the challenge these classes pose in the imbalanced scenario. \begin{table}
\begin{tabular}{l c c c c c} \hline
**Technique** & **Normal** & **DDoS** & **DoS** & **Reconnnaissance** & **Data Theft** \\ \hline XGBoost-MinMax & 0.881 & 0.988 & 0.991 & 0.945 & 0.552 \\ XGBoost-Standard & 0.755 & 0.921 & 0.935 & 0.880 & 0.458 \\ PCA-MinMax & **0.895** & **0.992** & **0.993** & **0.951** & **0.589** \\ PCA-Standard & 0.653 & 0.885 & 0.965 & 0.902 & 0.401 \\ CHI2-MinMax & 0.850 & 0.932 & 0.941 & 0.915 & 0.505 \\ \hline \end{tabular}
\end{table} 
Table 3: F1-score for all feature selection techniques with min–max and standard scalers. Nonetheless, the STL + LSTM combination consistently shows the best or near-best performance across all classes compared to other configurations. * **Impact on Error Rates (Figures 5 and 6):*
* These figures illustrate the FPR and FNR, respectively, crucial metrics for IDS utility. * Figure 5 (FPR) shows the proportion of non-attack instances incorrectly classified as Attack for each class type (interpretation for FPR (Normal) may differ). The simulated results indicate notably higher FPR values, e.g., STL + LSTM FPR for DDoS is **0.15**, compared to evaluations on balanced data, reflecting the difficulty of correctly identifying the rare Normal samples amidst a flood of attacks.