PGTAD: Real-Time and Lightweight Multivariate Time-Series Anomaly Detection for IoT Using Patch Gate GRU Autoencoder

The escalating diversity of Internet of Things (IoT) devices has intensified security challenges, as signature-based and heavyweight machine learning (ML) defenses often fall short in resource-constrained edge environments, unable to meet real-time demands. To overcome these limitations, we introduce Patch Gate Time-series Anomaly Detection (PGTAD), a novel, lightweight, unsupervised multivariate time-series (MVTS) anomaly detection algorithm specifically tailored for IoT network traffic. PGTAD is a Gated recurrent units (GRU) autoencoder-based framework that intelligently integrates features from three perspectives—forward sequences, backward sequences, and local patch segments—using a Gate Mechanism (GM). It employs sinusoidal positional encoding for temporal awareness and a patch operation to capture localized patterns. Anomaly detection is achieved via Mahalanobis distance on reconstruction errors. Extensive experiments on publicly available IoT network traffic datasets: Edge-IIoTset, CICIoT2023, CICIoMT2024, and CICIoV2024, utilizing both packet-based and flow-based feature perspectives, demonstrated PGTAD's superior performance. Evaluated using various F-score metrics (including point-wise, composite, and affiliation) and inference throughput, PGTAD achieved an average F-score of 0.92 and sustained over 480K packets per second on an NVIDIA Jetson Orin Nano 8GB development kit. This confirms its effectiveness and generalizability for real-time detection in IoT edge environments.