STFNIoT:Lightweight IoT Intrusion Detection Based on Explainable Analysis Using Spatiotemporal Fusion Networks

With the widespread popularity of IoT applications, IoT devices are increasingly becoming targets of cyber attacks. Existing intrusion detection systems usually face computing resource limitations and accuracy challenges when facing complex, high-dimensional attack traffic data. Therefore, this paper proposes a lightweight IoT intrusion detection framework STFNIoT based on interpretable analysis of spatiotemporal fusion networks, which combines principal component analysis (PCA) and deep learning models to address the above problems. PCA performs data dimensionality reduction to reduce feature redundancy while retaining key information. Subsequently, a spatiotemporal fusion network(STFN) is used for feature learning. STFN contains two key components: a convolutional neural network (CNN) for extracting spatial features and a bidirectional long short-term memory network (BiLSTM) for capturing time-dependent features, thereby efficiently learning the spatiotemporal relationship between IoT devices. In addition, the framework integrates the SHAP interpretability analysis algorithm, which can intuitively reveal the decision-making process of the model and enhance the transparency and reliability of the system. Experimental results show that STFNIoT achieves 100%, 97.70% and 97.15% accuracy in the binary, hexaclass and multiclass tasks of the Edge-IIoTset dataset, respectively, significantly improving the detection performance compared with existing methods. In addition, the modular design of the framework effectively reduces the computational overhead and is suitable for resource-constrained IoT environments. This study provides an efficient and explainable IoT intrusion detection method.