{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,9,10]],"date-time":"2026-09-10T05:10:32Z","timestamp":1789017032703,"version":"build-2803163510"},"reference-count":33,"publisher":"Frontiers Media SA","license":[{"start":{"date-parts":[[2026,9,10]],"date-time":"2026-09-10T00:00:00Z","timestamp":1788998400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"content-domain":{"domain":["frontiersin.org"],"crossmark-restriction":true},"short-container-title":["Front. Big Data"],"abstract":"<jats:sec>\n                    <jats:title>Introduction<\/jats:title>\n                    <jats:p>Conventional machine learning approaches to IoT intrusion detection treat each network flow record as an independent observation, discarding the relational structure that connects flows across source IPs, destination IPs, and subnet communities. This article presents IOTTRUST, a graph-augmented intrusion detection framework for IoT networks that constructs a directed network flow graph from the UNSW-NB15 dataset and enriches per-flow machine learning with 24 graph-derived topology features computed per source and destination IP.<\/jats:p>\n                  <\/jats:sec>\n                  <jats:sec>\n                    <jats:title>Methods<\/jats:title>\n                    <jats:p>All graph topology statistics are computed exclusively from the training partition and propagated to the test partition without access to test-set labels, eliminating the temporal leakage present in an earlier version of this study. The experimental design isolates the contribution of graph topology through a three-track comparison conducted on an identical 40,000-flow stratified sample with a fixed 70\/30 split (random seed 42): a Flow-Only baseline using the standard 43 UNSW-NB15 features, a Graph-Only model trained exclusively on 24 graph topology features, and the full IOTTRUST Hybrid model combining 22 numeric flow features with 24 graph features (46 total).<\/jats:p>\n                  <\/jats:sec>\n                  <jats:sec>\n                    <jats:title>Results<\/jats:title>\n                    <jats:p>\n                      Under this leakage-free, size-matched evaluation, Flow-Only achieves 98.98% accuracy and AUC = 0.9995 with FPR = 0.81%; Graph-Only alone reaches 97.89% accuracy and AUC = 0.9974 with FPR = 1.79%; and IOTTRUST Hybrid achieves 99.07% accuracy, AUC = 0.9996, Precision = 97.09%, Recall = 98.30%, and FPR = 0.74%, a modest but statistically significant improvement over Flow-Only (McNemar\n                      <jats:italic>p<\/jats:italic>\n                      = 0.295 on the held-out test set, paired\n                      <jats:italic>t<\/jats:italic>\n                      -test on five-fold cross-validated\n                      <jats:italic>F<\/jats:italic>\n                      1\n                      <jats:italic>p<\/jats:italic>\n                      = 0.026) and a substantial improvement over Graph-Only alone (McNemar\n                      <jats:italic>p<\/jats:italic>\n                      &amp;lt; 0.001).\n                    <\/jats:p>\n                  <\/jats:sec>\n                  <jats:sec>\n                    <jats:title>Discussion<\/jats:title>\n                    <jats:p>Community structure analysis on the training graph confirms that the attacker subnet (175.45.176.x, four IPs) accounts for over 90% of attack flows, exhibiting distinctive graph signatures that graph features capture directly. Feature importance analysis shows that 12 of the top 15 most important features in the leakage-free Hybrid model remain graph topology features, accounting for 60.4% of the top-15 importance mass, confirming that network relational structure continues to carry predictive information even under this stricter evaluation protocol.<\/jats:p>\n                  <\/jats:sec>","DOI":"10.3389\/fdata.2026.1885965","type":"journal-article","created":{"date-parts":[[2026,9,10]],"date-time":"2026-09-10T04:29:39Z","timestamp":1789014579000},"update-policy":"https:\/\/doi.org\/10.3389\/crossmark-policy","source":"Crossref","is-referenced-by-count":0,"title":["IOTTRUST: graph-based anomaly detection for IoT intrusion using network flow topology and community structure analysis on UNSW-NB15"],"prefix":"10.3389","volume":"9","author":[{"given":"Nachaat","family":"Mohamed","sequence":"first","affiliation":[{"name":"Homeland Security Department, Rabdan Academy","place":["Abu Dhabi, United Arab Emirates"]},{"name":"NEUSAI Technologies LLC","place":["Sharjah, United Arab Emirates"]}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Hamed","family":"Taherdoost","sequence":"additional","affiliation":[{"name":"Department of Arts, Communications and Social Sciences, School of Arts, Science and Technology, University Canada West","place":["Vancouver, BC, Canada"]},{"name":"GUS Institute, Global University Systems","place":["London, United Kingdom"]},{"name":"College of Technology and Engineering, Westcliff University","place":["Irvine, CA, United States"]},{"name":"Research and Development Department, Hamta Business Corporation","place":["Vancouver, BC, Canada"]},{"name":"Faculty of Information Technology, Victorian Institute of Technology","place":["Melbourne, VIC, Australia"]}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"1965","published-online":{"date-parts":[[2026,9,10]]},"reference":[{"key":"B1","doi-asserted-by":"publisher","first-page":"19","DOI":"10.1016\/j.jnca.2015.11.016","article-title":"A survey of network anomaly detection techniques","volume":"60","author":"Ahmed","year":"2016","journal-title":"J. Netw. Comput. Appl."},{"key":"B2","doi-asserted-by":"publisher","DOI":"10.1088\/1742-5468\/2008\/10\/P10008","article-title":"Fast unfolding of communities in large networks","author":"Blondel","year":"2008","journal-title":"J. Stat. Mech. Theory Exp."},{"key":"B3","first-page":"100534","volume":"19","author":"Catillo","year":"2022"},{"key":"B4","first-page":"5049","article-title":"Graph-based network traffic anomaly detection with multi-scale learning","volume":"20","author":"Ding","year":"2023","journal-title":"IEEE Trans. Netw. Serv. Manag"},{"key":"B5","doi-asserted-by":"publisher","first-page":"375","DOI":"10.1145\/1315245.1315292","article-title":"\u201cAn inquiry into the nature and causes of the wealth of internet miscreants,\u201d","author":"Franklin","year":"2007","journal-title":"Proceedings of the 14th ACM CCS"},{"key":"B6","first-page":"3908","article-title":"Graph-based botnet detection with temporal community analysis","volume":"20","author":"Hu","year":"2023","journal-title":"IEEE Trans. Dependable Secure Comput."},{"key":"B7","doi-asserted-by":"publisher","first-page":"349","DOI":"10.1145\/2413176.2413217","article-title":"\u201cBotFinder: finding bots in network traffic without deep packet inspection,\u201d","author":"Jacobs","year":"2012","journal-title":"Proceedings of the ACM CoNEXT"},{"key":"B8","doi-asserted-by":"publisher","first-page":"241","DOI":"10.1016\/j.ymssp.2017.11.024","article-title":"A review on the application of deep learning in system health management","volume":"107","year":"2018","journal-title":"Mech. Syst. Signal Process."},{"key":"B9","doi-asserted-by":"publisher","first-page":"107840","DOI":"10.1016\/j.comnet.2021.107840","article-title":"Machine learning methods for cyber security intrusion detection: datasets and comparative study","volume":"188","author":"Kilincer","year":"2021","journal-title":"Comput. Netw."},{"key":"B10","doi-asserted-by":"publisher","first-page":"107869","DOI":"10.1016\/j.compeleceng.2022.107869","article-title":"A comprehensive intrusion detection framework using boosting algorithms","volume":"100","author":"Kilincer","year":"2022","journal-title":"Comput. Electr. Eng."},{"key":"B11","doi-asserted-by":"publisher","first-page":"413","DOI":"10.1109\/ICDM.2008.17","article-title":"\u201cIsolation forest,\u201d","author":"Liu","year":"2008","journal-title":"Proceedings of the IEEE International Conference on Data Mining (ICDM)"},{"key":"B12","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1109\/NOMS54207.2022.9789878","article-title":"\u201cE-GraphSAGE: a graph neural network based intrusion detection system for IoT,\u201d","author":"Lo","year":"2022","journal-title":"Proceedings of the IEEE\/IFIP NOMS"},{"key":"B13","first-page":"7823","article-title":"Minimizing false negatives in intrusion detection via IoT network topology analysis","volume":"11","author":"Luo","year":"2024","journal-title":"IEEE Internet Things J."},{"key":"B14","doi-asserted-by":"publisher","first-page":"153","DOI":"10.1007\/BF02295996","article-title":"Note on the sampling error of the difference between correlated proportions or percentages","volume":"12","author":"McNemar","year":"1947","journal-title":"Psychometrika"},{"key":"B15","doi-asserted-by":"publisher","first-page":"102994","DOI":"10.1016\/j.scs.2021.102994","article-title":"A new distributed architecture for evaluating AI-based security systems at the edge: network TON-IoT datasets","volume":"72","author":"Moustafa","year":"2021","journal-title":"Sustainable Cities Soc."},{"key":"B16","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1109\/MilCIS.2015.7348942","article-title":"\u201cUNSW-NB15: a comprehensive data set for network intrusion detection systems (UNSW-NB15 network data set),\u201d","author":"Moustafa","year":"2015","journal-title":"Proceedings of the IEEE MilCIS"},{"key":"B17","doi-asserted-by":"publisher","first-page":"756","DOI":"10.1109\/ICDCS.2019.00080","article-title":"\u201cDIoT: a federated self-learning anomaly detection system for IoT,\u201d","author":"Nguyen","year":"2019","journal-title":"Proceedings of the IEEE International Conference on Distributed Computing Systems (ICDCS)"},{"key":"B18","doi-asserted-by":"publisher","first-page":"245","DOI":"10.1145\/586110.586144","article-title":"\u201cConstructing attack scenarios through correlation of intrusion alerts,\u201d","author":"Ning","year":"2002","journal-title":"Proceedings of the 9th ACM Conference on Computer and Communications Security (CCS)"},{"key":"B19","first-page":"2825","article-title":"Scikit-learn: machine learning in Python","volume":"12","author":"Pedregosa","year":"2011","journal-title":"J. Mach. Learn. Res."},{"key":"B20","first-page":"682","article-title":"Graph-based anomaly detection in industrial IoT networks","volume":"19","author":"Peng","year":"2023","journal-title":"IEEE Trans. Ind. Inform."},{"key":"B21","doi-asserted-by":"publisher","first-page":"1118","DOI":"10.1073\/pnas.0706851105","article-title":"Maps of random walks on complex networks reveal community structure","volume":"105","author":"Rosvall","year":"2008","journal-title":"Proc. Natl. Acad. Sci. USA"},{"key":"B22","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1109\/ICCNC.2019.8685636","article-title":"\u201cClustering enabled classification using ensemble feature selection for intrusion detection,\u201d","author":"Salo","year":"2019","journal-title":"Proceedings of the IEEE International Symposium on Networks, Computers and Communications (ISNCC)"},{"key":"B23","doi-asserted-by":"publisher","first-page":"117","DOI":"10.1007\/978-3-030-72802-1_9","article-title":"\u201cNetFlow datasets for machine learning-based network intrusion detection systems,\u201d","author":"Sarhan","year":"2021","journal-title":"Big data technologies and applications: 10th EAI international conference, BDTA 2020, and 13th EAI international conference on wireless internet, WiCON 2020"},{"key":"B24","year":"2024"},{"key":"B25","doi-asserted-by":"publisher","first-page":"5234","DOI":"10.1038\/s41598-019-41695-z","article-title":"From Louvain to Leiden: guaranteeing well-connected communities","volume":"9","author":"Traag","year":"2019","journal-title":"Sci. Rep."},{"key":"B26","first-page":"661","article-title":"A two-level hybrid model for anomalous activity detection in IoT networks","volume":"6","author":"Ullah","year":"2022","journal-title":"IEEE Trans. Emerg. Topics Comput. Intell"},{"key":"B27","doi-asserted-by":"crossref","first-page":"261","DOI":"10.1038\/s41592-019-0686-2","article-title":"SciPy 1.0: fundamental algorithms for scientific computing in Python","volume":"17","author":"Virtanen","year":"2020","journal-title":"Nat. Methods"},{"key":"B28","doi-asserted-by":"publisher","first-page":"43","DOI":"10.1007\/978-3-319-93698-7_4","article-title":"\u201cInsider threat detection with deep neural network,\u201d","author":"Yuan","year":"2018","journal-title":"Proceedings of the International Conference on Computational Science (ICCS)"},{"key":"B29","doi-asserted-by":"publisher","first-page":"1737","DOI":"10.3390\/electronics15081737","article-title":"SAGEConv-Transformer hybrid for network intrusion detection: a graph-based approach on UNSW-NB15","volume":"15","author":"Zhang","year":"2026","journal-title":"Electronics"},{"key":"B30","first-page":"1","article-title":"\u201cMalGraph: hierarchical graph neural networks for robust Windows malware detection,\u201d","volume-title":"Proceedings of the IEEE International Conference on Computer Communications (INFOCOM)","author":"Zhao","year":"2022"},{"key":"B31","first-page":"766","article-title":"HetBotGraph: heterogeneous network embedding for Twitter bot detection","volume":"634","author":"Zhao","year":"2023","journal-title":"Inf. Sci."},{"key":"B32","doi-asserted-by":"publisher","first-page":"633","DOI":"10.1145\/3485447.3512217","article-title":"\u201cET-BERT: a contextualized datagram representation with pre-training transformers for encrypted traffic classification,\u201d","author":"Zhou","year":"2022","journal-title":"Proceedings of the ACM TheWebConf"},{"key":"B33","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1186\/s40537-015-0013-4","article-title":"Intrusion detection and big heterogeneous data: a survey","volume":"21","author":"Zuech","year":"2015","journal-title":"J. Big Data"}],"container-title":["Frontiers in Big Data"],"original-title":[],"link":[{"URL":"https:\/\/www.frontiersin.org\/articles\/10.3389\/fdata.2026.1885965\/full","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,9,10]],"date-time":"2026-09-10T04:29:41Z","timestamp":1789014581000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.frontiersin.org\/articles\/10.3389\/fdata.2026.1885965\/full"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,9,10]]},"references-count":33,"alternative-id":["10.3389\/fdata.2026.1885965"],"URL":"https:\/\/doi.org\/10.3389\/fdata.2026.1885965","relation":{},"ISSN":["2624-909X"],"issn-type":[{"value":"2624-909X","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,9,10]]},"article-number":"1885965"}}