STFNIoT:Lightweight IoT Intrusion Detection Based on Explainable Analysis Using Spatiotemporal Fusion Networks

STFNIoT:Lightweight IoT Intrusion Detection Based on Explainable Analysis Using Spatiotemporal Fusion Networks | Research Square window.SnipcartSettings = { analytics: { enabled: false } }; (function() { var accessVector = localStorage.getItem('access_vector') || ''; window.dataLayer = window.dataLayer || []; if (accessVector) { window.dataLayer.push({ user: { profile: { profileInfo: { snid: accessVector } } } }); } })(); (function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start':new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0],j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src='https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f);})(window,document,'script','dataLayer','GTM-K279D39R'); Browse Preprints In Review Journals COVID-19 Preprints AJE Video Bytes Research Tools Research Promotion AJE Professional Editing AJE Rubriq About Preprint Platform In Review Editorial Policies Our Team Advisory Board Help Center Sign In Submit a Preprint Cite Share Download PDF Research Article STFNIoT:Lightweight IoT Intrusion Detection Based on Explainable Analysis Using Spatiotemporal Fusion Networks Hanlin Chen, Huan Liu, Wenjun Yang This is a preprint; it has not been peer reviewed by a journal. https://doi.org/ 10.21203/rs.3.rs-5880612/v1 This work is licensed under a CC BY 4.0 License Status: Posted Version 1 posted You are reading this latest preprint version Abstract With the widespread popularity of IoT applications, IoT devices are increasingly becoming targets of cyber attacks. Existing intrusion detection systems usually face computing resource limitations and accuracy challenges when facing complex, high-dimensional attack traffic data. Therefore, this paper proposes a lightweight IoT intrusion detection framework STFNIoT based on interpretable analysis of spatiotemporal fusion networks, which combines principal component analysis (PCA) and deep learning models to address the above problems. PCA performs data dimensionality reduction to reduce feature redundancy while retaining key information. Subsequently, a spatiotemporal fusion network(STFN) is used for feature learning. STFN contains two key components: a convolutional neural network (CNN) for extracting spatial features and a bidirectional long short-term memory network (BiLSTM) for capturing time-dependent features, thereby efficiently learning the spatiotemporal relationship between IoT devices. In addition, the framework integrates the SHAP interpretability analysis algorithm, which can intuitively reveal the decision-making process of the model and enhance the transparency and reliability of the system. Experimental results show that STFNIoT achieves 100%, 97.70% and 97.15% accuracy in the binary, hexaclass and multiclass tasks of the Edge-IIoTset dataset, respectively, significantly improving the detection performance compared with existing methods. In addition, the modular design of the framework effectively reduces the computational overhead and is suitable for resource-constrained IoT environments. This study provides an efficient and explainable IoT intrusion detection method. IoT Intrusion Detection Spatiotemporal Fusion Networks Principal Component Analysis Explainability Analysis Full Text Additional Declarations No competing interests reported. Cite Share Download PDF Status: Posted Version 1 posted You are reading this latest preprint version Research Square lets you share your work early, gain feedback from the community, and start making changes to your manuscript prior to peer review in a journal. As a division of Research Square Company, we’re committed to making research communication faster, fairer, and more useful. We do this by developing innovative software and high quality services for the global research community. Our growing team is made up of researchers and industry professionals working together to solve the most critical problems facing scientific publishing. Also discoverable on Platform About Our Team In Review Editorial Policies Advisory Board Help Center Resources Author Services Accessibility API Access RSS feed Manage Cookie Preferences © Research Square 2026 | ISSN 2693-5015 (online) Privacy Policy Terms of Service Do Not Sell My Personal Information {"props":{"pageProps":{"initialData":{"identity":"rs-5880612","acceptedTermsAndConditions":true,"allowDirectSubmit":true,"archivedVersions":[],"articleType":"Research Article","associatedPublications":[],"authors":[{"id":406238012,"identity":"54ddfea6-1095-4507-a65d-3cf6aeeaff76","order_by":0,"name":"Hanlin Chen","email":"","orcid":"","institution":"Tianjin University of Technology","correspondingAuthor":false,"prefix":"","firstName":"Hanlin","middleName":"","lastName":"Chen","suffix":""},{"id":406238013,"identity":"fba3beb3-bb9b-4534-a208-f21fc5f30648","order_by":1,"name":"Huan Liu","email":"","orcid":"","institution":"Tianjin University of Technology","correspondingAuthor":false,"prefix":"","firstName":"Huan","middleName":"","lastName":"Liu","suffix":""},{"id":406238014,"identity":"a66a4013-914b-48cd-9203-16ea73ad66d5","order_by":2,"name":"Wenjun Yang","email":"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAZAAAAAyAQMAAABI0h/eAAAABlBMVEX///8AAABVwtN+AAAACXBIWXMAAA7EAAAOxAGVKw4bAAAA00lEQVRIie3LMQ/BQBjG8edyienoehLBR6g06UJ8FiJhubAZ5Sws/QAVX+bkBgvt2oSBGBnYDCQqzK42iftPb948P8Bm+9lYA0Q+j1x20uVE0q8INAeyEne51kdWikc0HCichxrOXBrIqt+tM7bhJOyAhJEG3yoDUcL3xJvQ/ETD5S0DiU9PEr3IPRNJhHcQTL0IyUKKycmnN9YpjoODuwiiHuOJgRRi4V1mQdOpTdv73XVYLzuhgVQVcpwEQE0CKn2wz/u0igQ945oexqnNZrP9bQ/ZvkIjLW32GQAAAABJRU5ErkJggg==","orcid":"","institution":"Tianjin University of Technology","correspondingAuthor":true,"prefix":"","firstName":"Wenjun","middleName":"","lastName":"Yang","suffix":""}],"badges":[],"createdAt":"2025-01-22 11:53:22","currentVersionCode":1,"declarations":"","doi":"10.21203/rs.3.rs-5880612/v1","doiUrl":"https://doi.org/10.21203/rs.3.rs-5880612/v1","draftVersion":[],"editorialEvents":[],"editorialNote":"","failedWorkflow":false,"files":[{"id":78719273,"identity":"f222e34d-fb73-42ba-8026-d4e30eaf152f","added_by":"auto","created_at":"2025-03-18 04:01:32","extension":"pdf","order_by":1,"title":"","display":"","copyAsset":false,"role":"manuscript-pdf","size":1233812,"visible":true,"origin":"","legend":"","description":"","filename":"STFNIoTLightweightIoTIntrusionDetectionBasedonExplainableAnalysisUsingSpatiotemporalFusionNetworks.pdf","url":"https://assets-eu.researchsquare.com/files/rs-5880612/v1_covered_dfbb017d-7f9d-4128-a023-5612799e7821.pdf"}],"financialInterests":"No competing interests reported.","formattedTitle":"STFNIoT:Lightweight IoT Intrusion Detection Based on Explainable Analysis Using Spatiotemporal Fusion Networks","fulltext":[],"fulltextSource":"","fullText":"","funders":[],"hasAdminPriorityOnWorkflow":false,"hasManuscriptDocX":false,"hasOptedInToPreprint":true,"hasPassedJournalQc":"","hasAnyPriority":false,"hideJournal":true,"highlight":"","institution":"","isAcceptedByJournal":false,"isAuthorSuppliedPdf":true,"isDeskRejected":"","isHiddenFromSearch":false,"isInQc":false,"isInWorkflow":false,"isPdf":true,"isPdfUpToDate":true,"isWithdrawnOrRetracted":false,"journal":{"display":true,"email":"[email protected]","identity":"researchsquare","isNatureJournal":false,"hasQc":true,"allowDirectSubmit":true,"externalIdentity":"","sideBox":"","snPcode":"","submissionUrl":"/submission","title":"Research Square","twitterHandle":"researchsquare","acdcEnabled":true,"dfaEnabled":false,"editorialSystem":"","reportingPortfolio":"","inReviewEnabled":false,"inReviewRevisionsEnabled":true},"keywords":"IoT Intrusion Detection, Spatiotemporal Fusion Networks, Principal Component Analysis, Explainability Analysis","lastPublishedDoi":"10.21203/rs.3.rs-5880612/v1","lastPublishedDoiUrl":"https://doi.org/10.21203/rs.3.rs-5880612/v1","license":{"name":"CC BY 4.0","url":"https://creativecommons.org/licenses/by/4.0/"},"manuscriptAbstract":"\u003cp\u003eWith the widespread popularity of IoT applications, IoT devices are increasingly becoming targets of cyber attacks. Existing intrusion detection systems usually face computing resource limitations and accuracy challenges when facing complex, high-dimensional attack traffic data. Therefore, this paper proposes a lightweight IoT intrusion detection framework STFNIoT based on interpretable analysis of spatiotemporal fusion networks, which combines principal component analysis (PCA) and deep learning models to address the above problems. PCA performs data dimensionality reduction to reduce feature redundancy while retaining key information. Subsequently, a spatiotemporal fusion network(STFN) is used for feature learning. STFN contains two key components: a convolutional neural network (CNN) for extracting spatial features and a bidirectional long short-term memory network (BiLSTM) for capturing time-dependent features, thereby efficiently learning the spatiotemporal relationship between IoT devices. In addition, the framework integrates the SHAP interpretability analysis algorithm, which can intuitively reveal the decision-making process of the model and enhance the transparency and reliability of the system. Experimental results show that STFNIoT achieves 100%, 97.70% and 97.15% accuracy in the binary, hexaclass and multiclass tasks of the Edge-IIoTset dataset, respectively, significantly improving the detection performance compared with existing methods. In addition, the modular design of the framework effectively reduces the computational overhead and is suitable for resource-constrained IoT environments. This study provides an efficient and explainable IoT intrusion detection method.\u003c/p\u003e","manuscriptTitle":"STFNIoT:Lightweight IoT Intrusion Detection Based on Explainable Analysis Using Spatiotemporal Fusion Networks","msid":"","msnumber":"","nonDraftVersions":[{"code":1,"date":"2025-01-28 18:03:47","doi":"10.21203/rs.3.rs-5880612/v1","editorialEvents":[{"type":"communityComments","content":0}],"status":"published","journal":{"display":true,"email":"[email protected]","identity":"researchsquare","isNatureJournal":false,"hasQc":true,"allowDirectSubmit":true,"externalIdentity":"","sideBox":"","snPcode":"","submissionUrl":"/submission","title":"Research Square","twitterHandle":"researchsquare","acdcEnabled":true,"dfaEnabled":false,"editorialSystem":"","reportingPortfolio":"","inReviewEnabled":false,"inReviewRevisionsEnabled":true}}],"origin":"","ownerIdentity":"79184544-970d-4820-9b84-583f1c9eea74","owner":[],"postedDate":"January 28th, 2025","published":true,"recentEditorialEvents":[],"rejectedJournal":[],"revision":"","amendment":"","status":"posted","subjectAreas":[],"tags":[],"updatedAt":"2025-03-18T03:53:21+00:00","versionOfRecord":[],"versionCreatedAt":"2025-01-28 18:03:47","video":"","vorDoi":"","vorDoiUrl":"","workflowStages":[]},"version":"v1","identity":"rs-5880612","journalConfig":"researchsquare"},"__N_SSP":true},"page":"/article/[identity]/[[...version]]","query":{"redirect":"/article/rs-5880612","identity":"rs-5880612","version":["v1"]},"buildId":"8U1c8b4HqxoKbykW_rLl7","isFallback":false,"isExperimentalCompile":false,"dynamicIds":[84888],"gssp":true,"scriptLoader":[]}