Efficient Graph Neural Networks for Real-Time IoT Anomaly Detection

Thesis Abstract

The rapid expansion of Internet of Things (IoT) ecosystems across critical sectors, including manufacturing, healthcare, and smart cities, has intensified the demand for reliable, scalable, and real-time anomaly detection to safeguard operations and data integrity. Traditional anomaly detection approaches struggle with the heterogeneity, high dimensionality, and dynamic topology characteristic of IoT networks, leading to delayed responses and elevated false-alarm rates. This study addresses the problem by developing and evaluating Efficient Graph Neural Networks (EGNNs) tailored for real-time IoT anomaly detection, with a focus on computational efficiency, memory footprint, and robust generalization across evolving graph structures. The aim is to design, implement, and validate a graph-based deep learning architecture that enables real-time detection of anomalous behaviors in IoT networks while meeting stringent resource constraints. Specific objectives are (1) to formulate a graph representation of heterogeneous IoT environments capturing device-level features, inter-device communication patterns, and temporal dynamics; (2) to develop a lightweight EGNN that preserves expressive power through sparse attention mechanisms and graph sampling strategies to achieve sub-second inference on edge devices; (3) to integrate self-supervised pretraining to enhance detection capability under limited labeled data; (4) to evaluate model performance across multiple datasets with varying scale, topology, and attack scenarios; and (5) to analyze the trade-offs between detection accuracy, latency, and energy consumption to derive deployment guidelines for on-device anomaly detection. The methodology adopts a mixed-methods research design combining quantitative model development with empirical evaluation. The population consists of heterogeneous IoT testbeds comprising 2,000–5,000 nodes per scenario, including edge devices, gateways, and cloud components, simulated and augmented with real-world traces from a public IoT security dataset. A stratified sampling approach is used to curate representative subgraphs for training (1,200 samples) and testing (600 samples) under varying network loads and attack types (e.g., spoofing, replay, and data exfiltration). Data collection instruments include centralized and edge-embedded data collectors that capture structural features (degree, clustering, eigenvector centrality), temporal signals (inter-arrival times, payload statistics), and protocol metadata (MQTT, CoAP). The EGNN framework is trained with a combination of supervised cross-entropy and self-supervised tasks (masking and link prediction) to promote robust representations. Model selection and hyperparameter tuning employ grid search and Bayesian optimization, with evaluation metrics including F1-score, area under the ROC curve (AUC), inference latency, and energy usage per inference. Validity and reliability are established through cross-validation, ablation studies, and repeating experiments across three distinct datasets a synthetic benchmark, a public IoT security trace, and a real-world industrial control system trace. Ethical considerations address data privacy, secure handling of sensitive traces, and compliance with institutional data governance policies. The analytical framework leverages an EGNN with sparse attention and adaptive neighborhood sampling to handle large-scale, evolving graphs. The model’s objectives are regularized by a multi-task loss combining anomaly likelihood, temporal consistency, and reconstruction error. Statistical analyses include paired t-tests and non-parametric equivalents to compare the proposed EGNN against baseline methods such as conventional Graph Convolutional Networks, Graph Attention Networks, and traditional time-series detectors. Robustness analyses examine performance under node attrition, noisy features, and concept drift, with theoretical grounding in spectral graph theory and dynamic graph learning. Anticipated findings indicate that the proposed EGNN achieves a statistically significant improvement in F1-score by 8–12 percentage points over baselines while reducing average inference latency to below 100 milliseconds per node on edge devices and lowering energy consumption by 25–40%. The study contributes to knowledge by demonstrating that a carefully designed, resource-aware graph neural architecture can deliver reliable real-time anomaly detection in constrained IoT environments, bridging the gap between high-accuracy models and edge deployment feasibility. It advances theory in dynamic graph representation learning by integrating sparse attention, local graph sampling, and self-supervised pretraining within an efficient GNN framework. Practically, the research provides deployment guidelines, including recommended model sizes, feature sets, and on-device computation strategies suitable for industrial IoT deployments. The main conclusion posits that efficient GNNs, when tailored to the topology and temporal dynamics of IoT networks, can deliver timely and accurate anomaly detection with manageable energy footprints, paving the way for robust, scalable security in future IoT ecosystems. Recommendations emphasize iterative on-device learning, continuous concept-drift monitoring, and collaboration with network operators to maintain up-to-date models as IoT environments evolve.