Architecting an AI-Driven SOC: Comparative Evaluation of Deep Learning Models for Granular IoT Incident Response

The rapid proliferation of Internet of Things (IoT) devices has introduced significant vulnerabilities into modern network infrastructures, necessitating advanced real-time threat detection systems. This research proposes an AI-driven security framework utilizing the RT-IoT2022 dataset to classify twelve distinct categories of network activities, ranging from normal telemetry to complex attack vectors such as DDoS Slowloris, ARP poisoning, and Metasploit Brute Force. We implement and evaluate three deep learning architectures: Simple Recurrent Neural Networks (RNN), Long Short-Term Memory (LSTM), and Gated Recurrent Units (GRU). Our methodology emphasizes feature engineering through one-hot encoding of heterogeneous network logs and 3D tensor reshaping for temporal analysis. Experimental results demonstrate that while Simple RNNs struggle with long-term dependencies, Gated architectures specifically GRU provide a superior balance between classification accuracy and computational efficiency, making them ideal for deployment in resource-constrained IoT environments. The framework achieves high precision across multi-stage reconnaissance and exploitation phases, providing a robust foundation for automated incident response in an AI-driven Security Operations Center (SOC).