Real-time Explainable Anomaly Detection in IoT Networks Using Self-Supervised Graph Neural Networks

Project Abstract

In the rapidly expanding landscape of Internet of Things (IoT) environments, secure and reliable operation hinges on timely detection of anomalous behaviors across heterogeneous devices and networks. This research presents a real-time, explainable anomaly detection framework that leverages self-supervised learning and graph neural networks (GNNs) to model complex inter-device relationships and temporal dynamics without requiring extensive labeled data. The proposed approach constructs a dynamic heterogeneous graph where nodes represent IoT devices, edge types capture communication relations, and temporal features encode evolving network states. Self-supervised pretraining tasks, such as contrastive learning on augmented graphs and masked feature prediction, enable robust representation learning in data-scarce IoT settings and facilitate rapid adaptation to new devices and protocols. The core anomaly detection mechanism combines a scalable GNN encoder with a probabilistic anomaly scoring module that integrates both structural and temporal cues to detect subtle and context-dependent deviations from normal behavior. To ensure real-time performance, the framework employs incremental graph updates, online normalization, and efficient neighborhood aggregation techniques coupled with edge-level attention to highlight critical interactions contributing to anomalies. Explainability is achieved through post-hoc and intrinsic methods, including attention-based feature attribution, counterfactual reasoning, and locally interpretable anomaly paths that trace suspicious activity to specific devices, communication patterns, or protocol anomalies. The model is trained in a self-supervised fashion, reducing reliance on labeled intrusion or fault data, and leverages transfer learning to generalize across diverse IoT ecosystems. A multi-objective optimization balances precision, recall, and false positive rate, prioritizing low-latency detections suitable for edge deployments. We evaluate the approach on multiple IoT benchmarks and synthetic datasets reflecting smart home, industrial, and smart city scenarios, incorporating varied device heterogeneity, communication protocols, and adversarial behaviors. Metrics include detection latency, area under the receiver operating characteristic curve (AUC-ROC), precision-recall curves, F1-score, and explainability scores assessed by human expert evaluation and automated plausibility checks. Baseline comparisons cover traditional statistical detectors, supervised deep learning models, and unsupervised graph-based methods, highlighting improvements in detection accuracy, adaptability, and interpretability. Ablation studies quantify the contributions of self-supervised objectives, graph structure, temporal dynamics, and explainable components to overall performance. Key findings demonstrate that the self-supervised GNN approach achieves superior detection accuracy with substantially reduced labeling requirements, while the explainability module provides actionable insights into the root causes of anomalies, enhancing trust and facilitating rapid incident response. The framework proves robust to concept drift, scalable to millions of nodes, and adaptable to evolving attack vectors and device heterogeneity. Potential applications span proactive security orchestration, fault diagnosis, and network resilience planning in large-scale IoT deployments. The research contributes a holistic, end-to-end solution that unifies real-time anomaly detection, robust representation learning, and transparent explanations essential for secure and trustworthy IoT systems.

Project Overview

What This Project Is About

---

A plain-language overview of the topic and what the project investigates.

---

---

The Problem It Addresses

---

What problem or gap this project tackles and why it matters to the field or society.

---

---

Objectives of the Project

---

1. Identify common patterns of normal behavior in IoT networks.
2. Detect unusual or anomalous activities in real time.
3. Provide explanations for detected anomalies in a human-readable way.
4. Evaluate the approach on real IoT datasets and in simulated scenarios.
5. Compare self-supervised learning with traditional supervised methods.

---

---

What You Will Do Step by Step

---

1. Review IoT network basics and data types. 2. Collect or access labeled/unlabeled sensor data. 3. Build a graph-based model that learns normal network behavior without heavy labeling. 4. Implement explainable components to show why an anomaly is flagged. 5. Test in streaming mode to simulate real-time detection. 6. Validate results with accuracy, latency, and interpretability metrics. 7. Compare different training setups. 8. Document how to deploy the system in practice.

---

---

---

---

Expected Outcome

An end-to-end method that detects IoT anomalies in real time, with simple explanations for each alert, and an assessment showing its practicality and limitations.