IOTTRUST: graph-based anomaly detection for IoT intrusion using network flow topology and community structure analysis on UNSW-NB15

Abstract

Introduction Conventional machine learning approaches to IoT intrusion detection treat each network flow record as an independent observation, discarding the relational structure that connects flows across source IPs, destination IPs, and subnet communities. This article presents IOTTRUST, a graph-augmented intrusion detection framework for IoT networks that constructs a directed network flow graph from the UNSW-NB15 dataset and enriches per-flow machine learning with 24 graph-derived topology features computed per source and destination IP. Methods All graph topology statistics are computed exclusively from the training partition and propagated to the test partition without access to test-set labels, eliminating the temporal leakage present in an earlier version of this study. The experimental design isolates the contribution of graph topology through a three-track comparison conducted on an identical 40,000-flow stratified sample with a fixed 70/30 split (random seed 42): a Flow-Only baseline using the standard 43 UNSW-NB15 features, a Graph-Only model trained exclusively on 24 graph topology features, and the full IOTTRUST Hybrid model combining 22 numeric flow features with 24 graph features (46 total). Results Under this leakage-free, size-matched evaluation, Flow-Only achieves 98.98% accuracy and AUC = 0.9995 with FPR = 0.81%; Graph-Only alone reaches 97.89% accuracy and AUC = 0.9974 with FPR = 1.79%; and IOTTRUST Hybrid achieves 99.07% accuracy, AUC = 0.9996, Precision = 97.09%, Recall = 98.30%, and FPR = 0.74%, a modest but statistically significant improvement over Flow-Only (McNemar p = 0.295 on the held-out test set, paired t-test on five-fold cross-validated F1 p = 0.026) and a substantial improvement over Graph-Only alone (McNemar p < 0.001). Discussion Community structure analysis on the training graph confirms that the attacker subnet (175.45.176.x, four IPs) accounts for over 90% of attack flows, exhibiting distinctive graph signatures that graph features capture directly. Feature importance analysis shows that 12 of the top 15 most important features in the leakage-free Hybrid model remain graph topology features, accounting for 60.4% of the top-15 importance mass, confirming that network relational structure continues to carry predictive information even under this stricter evaluation protocol.