Minority-Class Internet of Things Anomaly Detection via Deep Learning Models Using CESNET-TimeSeries24 Dataset

Abstract

Accurate forecasting and anomaly detection in IoT networks are critical for maintaining secure and reliable operations. This study evaluates three deep learning architectures-Long Short-Term Memory (LSTM), Transformer, and Temporal Convolutional Network (TCN)-on the CESNET-TimeSeries24 dataset to assess their ability to capture complex temporal dependencies in network traffic. Comprehensive performance comparisons reveal that the LSTM model consistently achieves superior predictive accuracy, with a Mean Absolute Error (MAE) of $6.89 \times 10^{7}$, Mean Squared Error (MSE) of $4.44 \times 10^{16}$, and Root Mean Squared Error (RMSE) of $2.11 \times 10^{8}$. In classification metrics, LSTM attains $82.31 \%$ accuracy, $81.15 \%$ precision, $92.92 \%$ recall, and an F1-score of 86.63%, outperforming both Transformer and TCN models. The Transformer model achieves the highest recall (97.06%) and the lowest RMSE ($2.09 \times 10^{8}$), indicating robustness to large-magnitude errors, while TCN demonstrates a competitive F1-score ($86.29 \%$) with higher MAE. Visualizations of actual versus predicted values and training-validation loss curves confirm that LSTM provides the most stable and accurate predictions. These results highlight the effectiveness of LSTM for reliable IoT traffic forecasting and anomaly detection, balancing low regression error with high classification performance.