Context-aware anomaly detection by community detection in the Internet of Things

Abstract

This paper introduces a novel context-aware anomaly detection framework for the Internet of Things, leveraging community detection in multi-edge graphs with a heterogeneous Graph Neural Network (HeteroGNN) architecture to enhance network security. The proposed framework detects anomalies such as unexpected communication patterns among devices that rarely interact, unusual traffic spikes during off-hours, or deviations in the contextual and knowledge-based interactions of devices. For example, in an industrial IoT environment, unauthorized access or malicious activity can be inferred from unexpected communication within a device community after working hours. Our detection approach uses multi-edge graphs to model diverse interactions (network communication, context, knowledge) and applies community detection to capture stable graph structures. By incorporating these insights into a HeteroGNN, the framework effectively distinguishes anomalous edges while maintaining scalability and adaptability to dynamic network conditions. Experimental evaluation on the CIC-ToN-IoT and CIC-IDS2017 dataset demonstrates the framework’s superior accuracy, precision, and robustness, establishing it as a practical and effective solution for securing IoT networks against both known and emerging threats.