Enhancing IoT Anomaly Detection using Hybrid CNN-LSTM Model and Interpretable Feature Selection

Abstract

Securing Internet of Things (IoT) networks is an ongoing challenge. As more devices connect to the internet with limited resources, these systems have become more vulnerable to cyberattacks. Many attacks continually evolve and become more sophisticated. This highlights the need for scalable, efficient anomaly detection deployable close to IoT devices to minimize latency, while maintaining high accuracy with low memory and computational demands. Many solutions have been applied for enhancing the problem area, either they are heavy models unsuitable for edge devices or they lack generalizability with recent datasets and current attack traffic patterns. Our research suggests a lightweight anomaly detection model that combines Convolution Neural Network (CNN) and Long Short Term Memory (LSTM) model, to recognize patterns across both spatial and temporal dimensions, as well as identify significant relationships among an interpretable selected set of features. with SHapley Additive exPlanations (SHAP) for feature selection and Synthetic Minority Oversampling Technique - Edited Nearest Neighbors (SMOTE-ENN) for balancing the distribution of classes in the datasets. The model’s performance was evaluated using accuracy, precision, recall, and F1 parameters. Following the study, an accuracy rate of 99.12% for multiclassification is achieved in the CICIoT2023 dataset. In the TON_IoT dataset, a multiclassification success rate of 99.08% is reached. The model with 10 features selected achieved 99.0%, 98.85% in the CICIoT2023 and TON_IoT dataset. With just 43,406 trainable parameters and Top 10 features selected proposed framework offers a lightweight, explainable model that is effective for edge IoT devices with limited resources.