# Detecting Out-of-Distribution Samples in Complex IoT Traffic Based on Distance Loss
## 5 Discussion  
The rapid proliferation of IoT devices has intensified security concerns, particularly in the areas of intrusion detection and device identification. While traditional classification-based methods such as MSP and ODIN excel in closed-set classification, they struggle with OOD detection due to the complex, highly imbalanced nature of IoT traffic. The presence of a large number of class labels and dynamic traffic patterns further complicates the decision boundaries, thereby undermining the effectiveness of OOD detection. One fundamental limitation of classification-based methods lies in their reliance on the softmax cross-entropy loss, which tends to produce overconfident predictions for ID samples. This results in inflated softmax probabilities that obscure the ID-OOD distinction, limiting the efficacy of post hoc OOD scoring functions. As shown in our experiments, methods such as MSP and ODIN exhibit declining performance as the number of labeled classes increases and data imbalance worsens. To overcome these challenges, we introduce a novel OOD detection framework that partitions classes into groups based on feature similarity, thereby simplifying the decision space. By incorporating a distance-based representation learning approach, our method enhances feature separation by minimizing intra-group variance and maximizing inter-group distances. OOD detection is then performed using Mahalanobis distance relative to these learned feature groups. Additionally, we introduce a KDE-based adaptive thresholding mechanism to improve robustness across different IoT traffic distributions. Our experiments demonstrate that this method consistently outperforms existing approaches on both open-source datasets and real-world IoT scenarios. Nevertheless, this study has certain limitations that warrant further investigation. First, the effectiveness of the grouping strategy directly impacts detection performance, and different ID sample distributions require different group partitioning strategies. If the grouping is not well-optimized, OOD detection performance may degrade. In future work, we plan to explore more adaptive grouping strategies tailored to various ID sample distributions to enhance the robustness of our method. Additionally, our current approach primarily focuses on tabular traffic features. Future research should explore its applicability to alternative traffic representations, such as grayscale images and other feature modalities. Our current framework relies on supervised learning with labeled data, which limits its applicability where labeled samples are scarce. We intend to investigate semi-supervised and self-supervised approaches to leverage unlabeled data and improve OOD detection. \begin{table}
\begin{tabular}{l c c} \hline \hline
**Method** & **AUROC** & **FPR95** \\ \hline MSP & 0.5352 & 0.9874 \\ ODIN & 0.4514 & 0.9986 \\ Energy & 0.5001 & 0.9987 \\ Ours & 0.8176 & 0.3365 \\ \hline \hline \end{tabular}
\end{table} 
Table 9: AUROC and FPR95 performance on the IoT-23 dataset. In each trial, one class is selected as the OOD class. Despite the large scale and class imbalance, our method consistently outperforms the baselines. Finally, real-time and online OOD detection is essential for dynamic IoT environments with evolving traffic patterns. Future research will develop streaming-based detection pipelines with sliding window mechanisms and incremental density estimation to enable adaptive thresholding and timely detection. As IoT networks continue to scale in size and complexity, robust OOD detection will become increasingly critical for ensuring the security and reliability of cloud-edge collaborative environments. Our work provides a practical and effective contribution toward enhancing the robustness of classification-based IoT security systems, including intrusion detection and device authentication. Conceptualization, all authors; methodology, C.Z. and J.Z. ; software, C.Z. and M.F; validation, J.Z. and Y.C. ; formal analysis, M.F. and Y.C. ; investigation, C.Z. and M.F. ; resources, Y.L.