Malicious Traffic Detection in IoT via Improved Graph Attention Network and Multi-Network Fusion

The rapid proliferation of the Internet of Things (IoT) has intensified the threat of network intrusions, necessitating effective malicious traffic detection methods. To overcome the limitations of single models in capturing heterogeneous traffic features, this study proposes a novel approach, termed IGTL, which integrates an improved graph attention network (Improved-GAT) with a temporal convolutional network-long short-term memory (TCN-LSTM) fusion architecture. In the proposed framework, the dataset is preprocessed to obtain its traffic trajectories. Meanwhile, a multi-head attention mechanism is introduced into the Graph Attention Network (GAT) to enhance its pooling layer, which can result in a model referred to as Improved-GAT. Improved-GAT not only enhances the network's fitting capability during data processing but also assigns weights to neighboring nodes, thereby enabling the assessment of node importance. Furthermore, to avoid semantic loss during classification and improve the detection capability for intrusive data, a TCN-LSTM fusion network is constructed. TCN-LSTM uses a Temporal Convolutional Network (TCN) to extract spatial features of data traffic and leverages the feature memory capability of a Long Short-Term Memory (LSTM) network to effectively capture spatiotemporal correlation information in the data, which can improve the model's classification ability and thus enabling the identification of malicious traffic. Experimental evaluations on multiple benchmark datasets demonstrate that IGTL achieves superior detection accuracy and generalization compared to state-of-the-art baselines. Specifically, on the NF-BoT-IoT dataset, IGTL attains accuracy, precision, recall, and F1-score values of 0.8430, 0.8458, 0.8369, and 0.8381, respectively, outperforming all competing methods. This demonstrates that the IGTL has good detection performance for malicious traffic in the Internet of Things.