CCE Theses and Dissertations

Date of Award

2025

Document Type

Dissertation

Degree Name

Doctor of Philosophy in Computer Science (CISD)

Department

College of Computing and Engineering

Advisor

Wei Li

Committee Member

Ajoy Kumar

Committee Member

Ling Wang

Keywords

anomaly detection, CNN, deep learning, IoT security, LSTM, Transformer

Abstract

The rapid expansion of Internet of Things (IoT) networks has heightened the need for intelligent, automated Anomaly Detection (AD) systems to identify sophisticated and evolving cyber threats. This study designed, implemented, and evaluated a broad range of deep learning models—including Convolutional Neural Networks (CNN), Recurrent Neural Networks (RNNs) (Long Short-Term Memory (LSTM), Gated Recurrent Unit (GRU), Bidirectional Gated Recurrent Unit (BiGRU), Bidirectional Long Short-Term Memory (BiLSTM)), Transformer-based architectures, Autoencoders, and hybrid combinations—to address the challenge of multiclass anomaly classification in IoT traffic. Using two benchmark datasets, IoT-DS-2 and CIC-IoT-2023, we conducted extensive experiments to assess classification performance, training efficiency, and model generalizability under varying data complexities and class imbalance conditions.

The research found that hybrid architectures—especially those integrating CNNs for local feature extraction, RNNs for temporal pattern modeling, and Transformers for long-range contextual attention—consistently outperformed standalone models regarding accuracy, F1-score, and Receiver Operating Characteristic - Area Under the Curve (ROC-AUC). In particular, the CNN-LSTM-Transformer, CNN-BiGRU-BiLSTM, and LSTMTransformer models achieved top-tier results across binary and multiclass tasks while demonstrating strong adaptability to more complex and imbalanced scenarios presented by IoT-DS-2, CIC-IoT-2023. To address the class imbalance, we applied the Synthetic Minority Oversampling Technique (SMOTE), which significantly improved recall and F1 scores for attack types with fewer samples. We also analyzed training efficiency and resource usage, highlighting the trade-offs between model complexity and computational cost. Hyperparameter tuning experiments refined model performance by exploring learning rate, dropout, and attention parameter configurations. The results underscored the importance of hybridization in neural architectures and demonstrated the feasibility of deploying robust AD systems in diverse IoT environments.

Download
Share Feedback

Share

COinS