Similarity-driven intrusion detection for cloud-centric internet of things networks

Abstract

Cloud-centric internet of things (IoT) environments continuously generates heterogeneous network traffic, making intrusion detection increasingly challenging as attack behaviors evolve beyond previously observed patterns. Conventional intrusion detection systems (IDS) rely primarily on supervised classification, limiting their ability to generalize to unseen threats while providing limited explanation for detection decisions. This paper proposes similarity-driven intrusion detection framework (SiamIDS), a SiamIDS that employs behavioral similarity learning to identify malicious network traffic. The framework integrates an autoencoder for feature compression with a Siamese bidirectional long short-term memory (Bi-LSTM) network for temporal similarity modeling, while SHapley Additive exPlanations (SHAP) provide feature-level explanations and ordering points to identify the clustering structure (OPTICS) supports post-detection behavioral analysis of anomalous traffic. The proposed framework was evaluated on the CIC IoT-DIAD 2024 dataset and compared with representative baseline deep learning models. Experimental results achieved an overall accuracy of 99.76%, precision of 95.62%, recall of 98.98%, and an F1-score of 97.24%, demonstrating consistent detection performance across seven attack families. Reconstruction loss analysis confirmed stable latent feature learning, while SHAP explanations showed that multiple network attributes collectively influenced intrusion decisions. These findings demonstrate that behavioral similarity learning provides an accurate and interpretable solution for intrusion detection in cloud-centric IoT environments.