Protocol-Aware Anomaly Detection in IoT Networks Using Temporal Graph Neural Networks

The exponential proliferation of Internet of Things (IoT) devices has increased the complexity and volume of network traffic, posing substantial problems for effective anomaly detection. Traditional anomaly detection algorithms frequently fail to capture IoT network activities’ dynamic, temporal, and diverse character. In this paper, a novel protocol-aware anomaly detection system based on Temporal Graph Neural Network (TGNN) is proposed for the DySAT (Dynamic Self-Attention Network) architecture. Our method simulates network flows’ temporal dynamics and their topological structure. A protocol-level semantics is also provided to increase contextual understanding. This allows for more accurate identification of anomalies in complex IoT setups. The proposed approach is tested using the TON-IoT NetFlow dataset, an open-source dataset created by the University of Queensland as part of the NFV2-collection. This standard dataset is used for optimising network security to improve interoperability and analytical usefulness in cybersecurity. The experimental results demonstrate that the suggested model has an Area Under the Curve (AUC) of 0.99 and an accuracy of 99%, exceeding earlier efforts based on classical machine learning and static graph-based models. These findings show the efficacy of incorporating temporal dynamics and protocol awareness into anomaly detection for IoT networks.