An Internet of Things-Based Intelligent Network Traffic Analysis Framework for Anomaly Detection

Modern Internet of Things (IoT) ecosystems produce vast volumes of complex and dynamically changing traffic patterns, which significantly hinder the performance of traditional rule-based intrusion detection methods, especially when dealing with new attack scenarios, high heterogeneity, and concept drift.In this paper, we present a novel framework for intelligent network traffic analysis in IoT environments aimed at anomaly detection, which combines three important approaches: (i) flow-level representations derived from learning, (ii) low-overhead edge-based processing, and (iii) online adaptation to drifting concepts.Our approach supports not only classical feature-based pipelines (NetFlow and CICFlow-like traffic descriptors) but also advanced deep-learning pipelines without features based on direct analysis of packets' byte streams, thus enabling the usage of our system in resource-limited gateway devices or large-scale enterprise-class collectors.From an architectural perspective, the proposed solution consists of a series of stages that include traffic collection, normalization, semantic embedding, anomaly ranking, drift detection, and incremental adaptation.To address the persistent problems of sparsity and generalization inherent to modern IoT traffic analysis, we propose using context-aware embeddings, latent-space learning, and incremental/ensemble-based drift adaptation.We perform evaluation according to common classification metrics (accuracy, precision, recall, and F1-score) augmented by drift-specific metrics reflecting drift detection delays, recovery time after drift, and cost of adaptation procedures.