Autoencoder Flags IoT Network Attacks with Near-Perfect Precision Under Extreme Imbalance

Most intrusion detection research is tested on artificially balanced datasets, where attack and benign records appear in equal numbers. A new open-access study argues that this practice hides a problem that only appears in production networks, where attacks can outnumber benign packets hundreds to one. The paper evaluates an unsupervised detector called ST-HAE, a Spatio-Temporal Hybrid Autoencoder, under exactly those conditions, using two structurally different datasets: consumer IoT traffic from CIC-IoT 2023 with a 278.5-fold attack-to-benign test imbalance, and multi-architecture malware traffic from IoTMal-2026 with a 9.6-fold imbalance. The work was published in Discover Networks on 30 August 2026.

ST-HAE is a compact encoder-decoder network with just 60,151 parameters, built from a one-dimensional convolutional layer, a bidirectional LSTM, and a 16-dimensional compression bottleneck feeding an asymmetric decoder. It trains exclusively on benign traffic, learning to reconstruct the statistical manifold of legitimate communications. At inference, any input that the model reconstructs poorly is flagged as anomalous, using a threshold calibrated as the mean plus a multiple of the standard deviation of reconstruction errors on held-out benign validation data. Because the detector never sees attack labels at any point, its designers argue it can in principle catch zero-day attacks that no supervised classifier was ever shown during training.

The headline result concerns precision, the fraction of raised alerts that are genuine. Under the extreme 278.5-to-1 imbalance of the CIC-IoT 2023 test set, where attack traffic makes up 97.66 percent of all packets, ST-HAE achieved an alert precision of 0.9999 plus or minus 0.0000 across five random seeds, meaning fewer than one in ten thousand benign packets triggered a false alert. On IoTMal-2026, the model reached 95.85 percent accuracy plus or minus 0.03 percent and a five-seed mean ROC-AUC of 0.9799, detecting roughly 2.748 million of 2.867 million attack samples spanning ARM, MIPS, MIPSEL, and x86 malware, none of which were available during training.

The evaluation protocol is itself a central contribution. Rather than subsampling the attack pool to match the benign test split, the authors reserve the entire attack pool for testing, yielding imbalance ratios they argue reflect deployment-scale conditions rather than evaluation artefacts. All boxed results are means and standard deviations over five runs with independently chosen seeds. Under an identical protocol, ST-HAE matched or exceeded Deep SVDD, Deep SAD, and a Kitsune-architecture baseline. Notably, Deep SVDD proved unstable on the more heterogeneous dataset, with accuracy standard deviation reaching 10.0 percentage points across seeds, a signature the authors trace to hypersphere collapse, a documented failure mode of distance-based one-class learning that neither reconstruction-based method shared.

A category-level breakdown complicates the precision story considerably. Recall on high-volume flood attacks, including DDoS, DoS, and Mirai, was essentially perfect. Recall on slower, quieter attacks, such as reconnaissance, web exploits, brute force, and spoofing, ranged from roughly 7 to 40 percent depending on the category. Mean reconstruction error ran up to 454 times smaller for the stealthy group. Threshold sweeps using both Gaussian and nonparametric percentile calibration found no operating point that combined flood-level recall with an acceptable false alarm rate, even at a permissive threshold with a 12 percent false alarm rate. The authors conclude this is a genuine separation limit of the reconstruction-error signal itself, not something a different threshold could fix, a prediction their decision-theoretic threshold model makes once class separation is properly accounted for.

Feature attribution, computed exactly from the per-feature decomposition of reconstruction error and cross-checked against SHAP and LIME, explains the gap mechanistically. Flood detection depends heavily on one or two count-based features, particularly a packet and flow count statistic called Number, whose values under flood conditions fall so far outside the training range of the min-max scaler that its scaled error becomes disproportionately large. Stealthy attacks show the opposite signature: no single dominant feature, only a diffuse, low-amplitude deviation spread across many features. When the researchers retrained the model with the five dominant count features removed, detection did not collapse but dropped unevenly. Mirai recall barely moved, from 99.9 to 99.6 percent, while DoS recall fell from near-total to just above 59 percent, indicating reliance on these features is real but attack-mechanism-specific.

The ablation studies deliver an unusually candid verdict on the architecture’s own temporal component. Under a smaller, capacity-fair, balanced-protocol comparison, a convolution-only variant with under half the parameters matched or exceeded the full BiLSTM model on every metric, arguing that the recurrent stage contributes nothing to mean accuracy in that setting. Yet under the full imbalanced protocol on the heterogeneous IoTMal-2026 dataset, bidirectional encoding reduced seed-to-seed accuracy variance roughly 31-fold compared with a unidirectional encoder, driven by a single unidirectional run whose validation loss stalled for eight epochs and landed nearly two accuracy points below its other four seeds. The authors treat this reduction in training-run failure risk, not raw accuracy, as bidirectionality’s demonstrated contribution, and note explicitly that the BiLSTM processes channel positions of a single flow vector, not a literal multi-packet time series.

Edge deployability claims are grounded in direct measurement rather than extrapolation. Benchmarked end-to-end on physical AWS Graviton2 ARM64 hardware, single-sample inference averaged 1.82 milliseconds, a throughput of roughly 550 samples per second single-threaded. This corrects an earlier estimate extrapolated from GPU latency that had implied thousands of samples per second. The authors note this throughput remains adequate for a home or small-business gateway, which sees far fewer new flow records per second, but does not support high-throughput enterprise claims, and that sustained load, thermal throttling, and concurrent workloads were not measured.

The study is explicit about its limits. Both datasets come from the same source, the Canadian Institute for Cybersecurity, so a testbed-level bias shared by both cannot be ruled out from within the study. The benign-stationarity assumption underlying normalcy modelling will eventually be violated by firmware updates and topology changes, requiring recalibration or retraining. The threshold is calibrated per dataset and may not port to new environments. Adversarial evasion crafted to minimize reconstruction error remains an open question. And the Kitsune comparison reproduces that system’s ensemble architecture on flow-level features rather than its original raw-packet incremental extractor, so it should be read as architecture versus architecture.

The overall picture the authors draw is deliberately narrower than a typical detection-paper claim. ST-HAE is best understood not as a universally strong detector but as a precision-focused, edge-deployable one whose capabilities and limits are both measured under realistic imbalance. It catches volumetric floods almost without exception and raises almost no false alarms even when attacks dominate the traffic, but a deployment relying on it alone would need a complementary detector, or labelled fine-tuning of the kind Deep SAD uses, to close the gap on reconnaissance, brute force, spoofing, and web-based exploitation. The category-level asymmetry, they argue, is itself an argument for their evaluation protocol: aggregate metrics under artificial balance, or even under realistic imbalance without per-category detail, can obscure exactly the failure modes that matter most operationally.

Subject of Research: An unsupervised spatio-temporal autoencoder evaluated for intrusion detection in heterogeneous IoT network traffic under realistic class imbalance

Article Title: ST-HAE detects spatio-temporal anomalies in heterogeneous IoT networks under realistic class imbalance

Article References: Reddy, V. K., & Kuda, N. R. (2026). ST-HAE detects spatio-temporal anomalies in heterogeneous IoT networks under realistic class imbalance. Discover Networks, 2(1), Article 30. https://doi.org/10.1007/s44354-026-00046-x

Image Credits: AI Generated

DOI: 10.1007/s44354-026-00046-x

Keywords: intrusion detection, IoT security, autoencoder, class imbalance, anomaly detection, edge computing, CIC-IoT 2023, malware traffic, deep learning, reconstruction error, zero-day attacks, network security