3.1.1. IoT device network logs.

The IoT logs, recorded in semi-structured CSV format, contain fields such as timestamps, source and destination IP addresses, port numbers, message payloads, and device metadata. Since this dataset is unlabeled and primarily log-based, we processed it as a sequence of structured log entries.

1. 1. Log Parsing and Tokenization: Each log entry was parsed into a sequence of discrete fields and payload tokens:

(1)

where is the timestamp, and are source and destination IPs, is the port, and is the message payload. The payload was tokenized using byte-pair encoding (BPE) for subword-level generalization.

1. 2. Timestamp Normalization: We normalized timestamps using min-max scaling:

(2)

where T is the set of all timestamps. This scaling preserved temporal relationships and made the time dimension compatible with neural network inputs.

1. 3. IP Address Encoding: IPs were numerically encoded via learned embeddings. Each unique IP address was mapped using:

(3)

This representation captures similarity across devices and flows based on learned traffic behavior.

1. 4. Autoencoder-Based Feature Learning: To obtain unsupervised latent representations from the preprocessed IoT logs, we trained a sequence autoencoder:

(4)

where is the encoder, is the decoder, and is the learned latent vector. We minimized reconstruction loss:

(5)

3.1.2. UNSW-NB15 dataset.

The UNSW-NB15 dataset consists of labeled network flow records with 49 features and 10 class labels (normal + 9 attack types). This dataset was used for supervised training of the behavioral auditing branch.

1. 1. Feature Selection and Cleaning: We removed redundant identifiers (e.g., id, label_name) and retained only numeric and categorical fields relevant for traffic analysis. Missing values were filled using median imputation:

(6)

1. 2. Categorical Encoding: Protocol and service fields were one-hot encoded:

(7)

1. 3. Feature Normalization: All continuous features were standardized using z-score normalization:

(8)

where and are the mean and standard deviation of feature j.

1. 4. Sequence Construction: To model temporal dependencies in traffic behavior, we grouped flows into sequences of k = 10 using sliding windows:

(9)

where r(y) denotes the risk priority assigned to each class. This risk-preserving rule avoids suppressing minority or high-risk attack labels in mixed windows, unlike a simple majority-vote rule. For the reported experiments, sequence windows were generated with a non-overlapping stride of k = 10 to avoid overlap-induced leakage between adjacent flow sequences. Thus, the official UNSW-NB15 test partition containing 82,332 flow records produced 8,233 test sequences after discarding the final two incomplete records. To verify that windowing did not remove minority classes, we compared the class distribution before and after sequence construction. At the record level, the test partition contained Normal: 37,000, Fuzzers: 6,062, Analysis: 677, Backdoors: 583, DoS: 4,089, Exploits: 11,132, Generic: 18,871, Reconnaissance: 3,496, Shellcode: 378, and Worms: 44 records. After non-overlapping windowing and risk-preserving label assignment, the corresponding sequence-level counts were Normal: 3,698, Fuzzers: 606, Analysis: 68, Backdoors: 58, DoS: 409, Exploits: 1,113, Generic: 1,887, Reconnaissance: 350, Shellcode: 38, and Worms: 6. These counts show that minority attack categories remain represented after windowing, while the final sequence-level evaluation uses all 8,233 test sequences.

3.1.3. Dataset partitioning.

After preprocessing, we partitioned both datasets into training, validation, and test sets with the following ratios:

(10)

We ensured temporal and class distribution consistency by applying stratified sampling for labeled data and uniform time-block sampling for the IoT logs.

3.1.4. Final tensor construction.

The final input tensors for the dual-stream model were constructed as:

(11)

(12)

where is the latent dimension from the IoT autoencoder, k is the sequence length, and is the number of features per flow record.

This structured preprocessing enables our deep auditing architecture to efficiently learn from both configuration-level log sequences and flow-level behavioral patterns, supporting robust compliance anomaly detection in hybrid network environments.

The IoT log dataset and UNSW-NB15 flow dataset are treated as complementary audit-evidence sources. The IoT stream captures device-level operational and configuration-related behavior through reconstruction-based log representation learning, while the UNSW-NB15 stream captures flow-level communication and security behavior through supervised sequence modeling. The proposed framework aligns these sources after modality-specific encoding, where both streams are projected into a common latent audit-evidence space. This evidence-level alignment is appropriate for network auditing because operational logs and flow records often provide different but complementary views of the same broader security and compliance context. The fusion stage therefore evaluates how device-level log deviations and flow-level behavioral patterns jointly contribute to compliance-risk detection.

3.2.1. Problem definition.

Given two complementary audit-evidence sources, we formulate the task as multimodal compliance-risk detection from device-level operational logs and flow-level behavioral security records:

• : IoT device log entries used to learn normal operational and configuration-related log structure through reconstruction-based representation learning.
• : labeled network flow sequences used to learn behavioral security patterns associated with normal, anomalous, unauthorized, and attack-like traffic.

This formulation follows the practical observation that network auditing is rarely based on a single homogeneous data source. Auditors and monitoring systems commonly interpret device logs and network flows together because logs describe device-level operational behavior, while flow records describe communication behavior and security-relevant activity. In DSDAN, low log reconstruction error and normal flow behavior support the compliant category. Increasing reconstruction deviation indicates abnormal operational or configuration behavior and is used to identify policy drift or configuration-violation risk. Flow-level attack or anomaly labels provide behavioral evidence for behavioral anomaly and confirmed attack categories.

The five output categories are therefore defined as audit-relevant compliance-risk abstractions. They consolidate the original UNSW-NB15 flow taxonomy according to auditing severity and behavioral meaning while incorporating reconstruction-based evidence from the IoT log stream. The normal UNSW-NB15 class supports compliant behavior, lower-severity or probing traffic patterns such as Fuzzers, Analysis, and Reconnaissance support behavioral-anomaly evidence, and higher-risk attack categories such as Backdoors, DoS, Exploits, Generic, Shellcode, and Worms support confirmed-attack evidence. The IoT log stream complements these flow labels by contributing reconstruction-based evidence of abnormal device or configuration behavior. This design allows the model to learn a unified risk representation from heterogeneous but audit-relevant evidence sources.

Our goal is to learn a unified model that detects:

• Log-level deviation patterns that indicate policy drift or possible configuration violation.
• Flow-level behavioral anomalies and attack patterns that indicate elevated compliance risk.
• A fused compliance-risk category derived from both log and flow evidence.

3.2.2. Model pipeline.

The DSDAN consists of two parallel branches:

1. Unsupervised IoT Stream: Learns latent configuration states from IoT logs using a sequence autoencoder.
2. Supervised Flow Stream: Classifies traffic sequences into compliance classes using a CNN-BiLSTM model.

Both branches share representations at an intermediate fusion layer and output a compliance risk score.

3.2.3. IoT log representation learning.

Each preprocessed IoT log sequence is passed through an encoder network :

(13)

where is the latent configuration representation. The reconstruction is computed by a decoder :

(14)

We minimize the reconstruction loss:

(15)

Latent vectors are then passed to the fusion layer for compliance reasoning.

3.2.4. Flow-based supervised classification.

Let be a sequence of k flows. Each is a feature vector. We first apply a CNN to extract local flow patterns:

(16)

The CNN outputs are passed to a BiLSTM to capture temporal dependencies:

(17)

A softmax classifier maps the sequence state to a predicted compliance label:

(18)

The classification loss is defined using cross-entropy:

(19)

The CNN-BiLSTM design was selected because the flow stream uses short sequential windows of network records, where local packet-flow interactions and bidirectional temporal dependencies are both relevant. The convolutional layer captures local feature transitions among adjacent flow records, while the BiLSTM models forward and backward temporal context within each window. Transformer-based encoders are powerful for long-range sequence modeling, but their self-attention mechanism introduces higher computational cost and typically benefits from larger training corpora or longer sequences. Since the auditing pipeline targets low-latency compliance detection with compact flow windows, CNN-BiLSTM provides a suitable balance between temporal modeling capacity, parameter efficiency, and inference speed.

3.2.5. Fusion and joint reasoning.

To jointly reason over static and dynamic perspectives, we fuse the representations:

(20)

Here, denotes vector concatenation after both modality-specific representations are projected into a common latent audit-evidence space. The index i denotes the training-batch instance used for joint optimization of the two evidence streams, not a raw timestamp-level or packet-level record match. This design is based on evidence-level fusion: the IoT branch represents log-level operational and configuration-deviation evidence, while the flow branch represents traffic-level behavioral and security evidence. By aligning both representations in the latent space, the model learns whether the combination of log-derived and flow-derived evidence improves compliance-risk prediction. The fused vector is passed through fully connected layers:

(21)

The fusion module provides task-specific evidence integration for auditing-oriented risk prediction. The IoT stream contributes reconstruction-based deviation evidence from device logs, while the flow stream contributes supervised behavioral evidence from network traffic sequences. Combining these representations allows the classifier to distinguish cases where a flow-level anomaly is supported by log-level deviation from cases where only one modality shows abnormal behavior. Thus, the dual-stream design is defined by its compliance-risk formulation, joint optimization of heterogeneous evidence sources, and empirical validation through ablation. A detailed layer-wise pipeline of the DSDAN model is shown in Fig 1.

Download:

• PNG
  larger image
• TIFF
  original image

Fig 1. Detailed layer-wise pipeline of the DSDAN model.

https://doi.org/10.1371/journal.pone.0357204.g001

3.4.1. Loss functions.

The DSDAN framework incorporates three loss components: an unsupervised reconstruction loss for the IoT log autoencoder, a supervised classification loss for the flow-based network, and a fusion-level prediction loss for the final compliance risk class.

• IoT Autoencoder Loss: The IoT reconstruction objective follows the same mean squared error formulation defined in Eq. (15), where the autoencoder minimizes the difference between each input log sequence and its reconstruction.
• Flow Classification Loss: The supervised flow-stream objective follows the same cross-entropy formulation defined in Eq. (19), where the CNN-BiLSTM branch learns to classify network flow sequences into the corresponding risk categories.
• Fusion Prediction Loss: After combining both streams, we apply an additional softmax classifier and compute cross-entropy over the fused output:

(22)

The final total loss is a weighted sum of the three components:

(23)

where , , and control the contributions of the IoT reconstruction loss, flow classification loss, and fused prediction loss, respectively. These values were selected to give slightly higher weight to supervised flow classification while retaining balanced contributions from log reconstruction and fused risk prediction. The same loss weights were used across all reported DSDAN experiments and are also listed in the implementation hyperparameter summary in Section 3.4.2.

3.4.2. Optimization and hyperparameters.

We trained the model using the Adam optimizer with , , , and weight decay of 10⁻⁵. The initial learning rate was set to:

(24)

and reduced using cosine decay to a minimum learning rate of during training. A batch size of B = 64 was used for all training steps. We applied dropout regularization with a dropout probability:

(25)

to prevent overfitting. Early stopping was employed based on validation loss with a patience of 10 epochs. All model weights were initialized using Xavier uniform initialization, and gradient clipping with a maximum norm of 1.0 was applied to stabilize recurrent training. Table 2 summarizes the training and implementation hyperparameters used for all DSDAN experiments.

Download:

• PNG
  larger image
• TIFF
  original image

Table 2. Training and implementation hyperparameters.

https://doi.org/10.1371/journal.pone.0357204.t002

3.4.3. Training procedure.

The training of DSDAN was carried out in three main stages:

1. Autoencoder Pretraining: We first pretrained the IoT autoencoder using only the unlabeled log data to learn meaningful latent representations by minimizing .
2. Supervised Flow Stream Training: The CNN-BiLSTM module was trained using the labeled flow dataset to classify each sequence and minimize .
3. Joint Fine-Tuning with Fusion: Finally, we jointly fine-tuned the entire model, including the autoencoder, flow classifier, and fusion layers, using the combined loss .

Each training run used 70% of the data for training, 15% for validation, and 15% for testing. All experiments were implemented in Python 3.10 using PyTorch 2.1.0 and CUDA 12.1, and executed on a workstation equipped with an Intel Core i7-12700K CPU, 32 GB RAM, and an NVIDIA GeForce RTX 3080 GPU with 10 GB VRAM. The average training time per epoch was 18.4 seconds for IoT autoencoder pretraining, 21.7 seconds for supervised flow-stream training, and 29.6 seconds for joint DSDAN fine-tuning. These values were measured under the same hardware and batch-size configuration used for the reported experiments. For reproducibility, the Python, NumPy, and PyTorch random generators were initialized using the selected seed before each run. Deterministic CUDA behavior was enabled where supported by the backend, and the same train-validation-test split protocol was used for all baselines and DSDAN variants. The main reported run used seed 42, while repeated-run statistics were computed using seeds 42, 123, 777, 2024, and 3407.

3.4.4. Inference and compliance decision.

At inference time, DSDAN processes the two modalities as complementary audit-evidence streams. An IoT log sequence l is encoded into a log-deviation vector , and a network flow sequence x is encoded into a behavioral vector . These vectors are projected into a shared latent evidence space and fused to support compliance-risk prediction. This design reflects practical auditing workflows in which device logs and flow records provide different but complementary views of network behavior. In deployment, the same inference pipeline can incorporate organization-specific temporal, device-level, or policy-level pairing rules when co-observed logs and flows are available. The fused representation is processed by the final classifier to predict a compliance-risk category.

The final output class is chosen from five audit-relevant compliance-risk categories defined in Section 3.2.1 through the mapping of log-deviation evidence and flow-level behavioral evidence. For implementation, these categories are indexed from 0 to 4, while their semantic meanings are defined as follows:

(26)

This decision provides a fine-grained compliance-risk assessment across log-level deviation evidence and flow-level behavioral evidence. For operational use, the inference output also includes diagnostic explanation fields: the predicted risk class, the softmax confidence score, the IoT log reconstruction error, the relative contribution of each stream at the fusion layer, and the top-ranked flow features estimated through gradient-based attribution. These outputs support analyst triage by showing whether a decision is mainly driven by log deviation, flow behavior, or both modalities.

4.1.1. IoT device network logs.

This dataset contains network logs collected from IoT devices (e.g., ultrasonic sensors connected via Arduino and NodeMCU with ESP8266) communicating over Wi‑Fi. Each entry includes a timestamp, source/destination IPs, ports, and message payloads. It provides realistic, semi-structured logs suitable for configuration-level anomaly detection via an autoencoder [34]. Dataset link: https://www.kaggle.com/datasets/speedwall10/iot-device-network-logs

4.1.2. UNSW‑NB15.

The UNSW-NB15 dataset comprises network flow records generated using IXIA PerfectStorm traffic in a cyber range, labeled across one “normal” category and nine attack categories (Fuzzers, DoS, Exploits, etc.). Raw pcap captures were transformed into 49 feature fields via Argus and Bro‑IDS tools, with over 2.5 million total records. A training subset of 175,341 records and a testing subset of 82,332 records (balanced across classes) were used for model evaluation [35]. Dataset link: http://kaggle.com/datasets/mrwellsdavid/unsw-nb15 After non-overlapping sequence construction with k = 10, the 82,332 test records yielded 8,233 sequence-level test samples. The confusion matrix and all reported classification metrics are therefore based on the sequence-level evaluation protocol. UNSW-NB15 is used in this study as a flow-level behavioral security benchmark that is relevant to compliance-risk auditing. Although it was originally developed for intrusion detection research, its labeled traffic categories capture normal, anomalous, unauthorized, and attack-like network behaviors that are directly useful for modeling flow-level evidence in auditing scenarios. In practical network compliance assessment, abnormal traffic behavior, unauthorized communication patterns, exploitation attempts, denial-of-service behavior, and reconnaissance activity are important indicators of policy violation or elevated compliance risk. Therefore, UNSW-NB15 provides an appropriate supervised source for learning the behavioral branch of DSDAN, while the IoT log dataset provides complementary device-level operational and configuration-deviation evidence.

4.2.1. Accuracy and F1-score evaluation.

Table 3 presents a combined comparison of accuracy and F1-score metrics across all evaluated models. The proposed Dual-Stream Deep Auditing Network consistently outperforms baseline approaches in both accuracy and classification balance. DSDAN achieves the highest overall accuracy of 93.2% and mean class accuracy of 91.7%, indicating strong generalization across diverse compliance categories. In addition, it records the highest macro F1-score (0.918) and micro F1-score (0.927), demonstrating its ability to maintain balanced precision and recall across both majority and minority classes. In contrast, models such as CNN-BiLSTM and GRU-Attention show competitive performance but exhibit lower macro F1-scores, suggesting reduced sensitivity to underrepresented classes. Random Forest performs efficiently but lacks the capacity to capture complex temporal dependencies, resulting in lower overall performance. These results confirm the effectiveness of the dual-stream architecture in learning robust representations from both structured and unstructured data.

Download:

• PNG
  larger image
• TIFF
  original image

Table 3. Accuracy and F1-score comparison.

https://doi.org/10.1371/journal.pone.0357204.t003

4.2.2. AUC-ROC and precision-recall evaluation.

Table 4 presents a combined evaluation of AUC-ROC and precision-recall metrics across all models. These metrics assess the model’s ability to distinguish between compliance states and maintain high precision under varying recall levels. The proposed DSDAN model achieves the highest overall AUC of 0.957 and average class AUC of 0.951, indicating strong discriminative capability across both majority and minority classes. These results demonstrate the model’s effectiveness in separating compliant and non-compliant behaviors, even in complex or ambiguous scenarios.

Download:

• PNG
  larger image
• TIFF
  original image

Table 4. Combined AUC-ROC and precision-recall performance comparison.

https://doi.org/10.1371/journal.pone.0357204.t004

In addition, DSDAN records the highest PR-AUC (0.948) and precision at 0.8 recall (0.879), confirming its ability to maintain high precision while capturing a large proportion of true violations. This balance is critical in auditing systems, where excessive false positives can reduce trust and operational efficiency. In contrast, baseline models such as Random Forest and Hybrid AE-CNN show lower AUC and PR-AUC values, reflecting limited performance in edge cases and a weaker ability to preserve precision at higher recall levels. These findings further validate the robustness of the dual-stream architecture in handling heterogeneous network data.

To better align the evaluation with operational auditing objectives, we also report risk-screening metrics that reflect analyst-facing performance. These metrics focus on high-risk violation detection, false alert control, and deployment feasibility rather than only aggregate classification accuracy. Table 5 reports the operational auditing metrics used to assess high-risk detection, false-alert control, and inference efficiency.

Download:

• PNG
  larger image
• TIFF
  original image

Table 5. Operational auditing-oriented evaluation of DSDAN.

https://doi.org/10.1371/journal.pone.0357204.t005

These results provide operational risk-screening indicators for analyst-facing compliance-risk assessment. The high-risk recall and missed high-risk rate quantify the model’s ability to reduce overlooked severe events, while the false alert rate measures the expected review burden on compliant cases. Precision at fixed recall further reflects the thresholded operating condition used for auditing, where maintaining sufficient recall is required before optimizing precision. Together, these metrics provide a closer connection between numerical model performance and practical auditing objectives.

4.2.3. IoT log reconstruction loss.

Table 6 presents the reconstruction performance on IoT device logs using mean squared error (MSE) and mean absolute error (MAE). Since reconstruction loss is meaningful only for models that reconstruct the input sequence, this comparison uses reconstruction-capable baselines rather than purely discriminative classifiers such as Random Forest, CNN-BiLSTM, or GRU-Attention. The evaluated reconstruction baselines include Conv-AE, LSTM-AE, GRU-AE, and Hybrid AE-CNN, all trained on the same IoT log representation. These baselines are used only for reconstruction-loss evaluation and are not included in the classification tables. These values quantify how accurately each model captures the normal operational behavior of devices, with lower scores indicating better reconstruction fidelity. The proposed DSDAN model achieves the lowest MSE (0.031) and MAE (0.020), outperforming all baseline models. This result highlights the strength of DSDAN’s log-specific encoder-decoder stream in learning fine-grained temporal and structural patterns inherent in device activity. In comparison, models such as GRU-Attention and Hybrid AE-CNN exhibit higher reconstruction errors, suggesting limited capacity to fully model log-level dependencies. These findings confirm DSDAN’s ability to distinguish deviations in log data that may signal policy violations or operational anomalies.

Download:

• PNG
  larger image
• TIFF
  original image

Table 6. Reconstruction loss on IoT logs using reconstruction-capable models (lower is better).

https://doi.org/10.1371/journal.pone.0357204.t006

4.2.4. Inference latency and resource use.

Table 7 compares the inference latency and memory consumption of all evaluated models. As expected, Random Forest offers the fastest inference speed at 1.9 ms and the lowest memory footprint at 85 MB, due to its non-sequential, tree-based architecture. However, this efficiency comes at the cost of reduced predictive performance, as previously shown in accuracy and AUC metrics. The proposed DSDAN model demonstrates competitive efficiency, requiring only 3.1 ms per inference and 110 MB of memory on average. While marginally slower than simpler models, DSDAN delivers significantly higher detection performance, making it suitable for deployment in systems where both speed and precision are critical. These results affirm that the proposed model maintains a favorable trade-off between computational cost and analytical power. The latency and memory results are reported as efficiency indicators for single-device inference. Under the tested hardware configuration, DSDAN provides near-real-time compliance-risk screening while maintaining higher predictive performance than simpler baseline models. Future deployment studies can further examine load testing, distributed execution, and throughput behavior under varying network scales.

Download:

• PNG
  larger image
• TIFF
  original image

Table 7. Inference latency and memory usage.

https://doi.org/10.1371/journal.pone.0357204.t007

4.2.5. Ablation study.

To assess the contribution of each component in the proposed framework, we conducted an ablation study by comparing the full DSDAN model with reduced variants. The evaluated variants include the IoT log stream only, the UNSW flow stream only, late fusion without joint fine-tuning, and DSDAN without the IoT reconstruction loss. This analysis evaluates whether both branches and the fusion mechanism contribute to the final compliance-risk prediction. Table 8 presents the ablation results for evaluating the contribution of each DSDAN stream, the fusion strategy, and the reconstruction objective.

Download:

• PNG
  larger image
• TIFF
  original image

Table 8. Ablation study of DSDAN components.

https://doi.org/10.1371/journal.pone.0357204.t008

The ablation results provide empirical evidence for the necessity of the dual-stream design and the fusion strategy. The IoT-only variant achieves lower performance, indicating that reconstruction-based log deviation alone is not sufficient for complete compliance-risk classification. The flow-only variant is stronger because it uses labeled behavioral evidence, but the full DSDAN model improves over it by 2.0 percentage points in accuracy, 0.025 in macro F1-score, 0.016 in AUC, and 0.024 in PR-AUC, showing the added value of log-level deviation evidence. This gain directly supports the central claim that dual-stream fusion is beneficial, since the jointly optimized DSDAN model outperforms both single-stream variants and the non-joint late-fusion variant across all reported ablation metrics. The model without reconstruction loss also performs below the full DSDAN model, confirming that preserving the log reconstruction objective contributes to risk prediction. These results clarify that the contribution is not the use of standard autoencoder, CNN-BiLSTM, or concatenation components in isolation, but their task-specific integration and joint validation for multimodal compliance-risk detection.

4.2.6. Repeated-run statistical and robustness evaluation.

To assess the stability and statistical reliability of the results, each model was evaluated over five independent runs using different random seeds. Table 9 presents the repeated-run performance and statistical comparison of DSDAN with the baseline models over five independent runs. We report the mean and standard deviation of the main metrics and apply a paired two-sided t-test between DSDAN and each competing model using macro F1-score as the comparison metric. In addition to the original baselines, we include stronger neural baselines: a Transformer encoder for flow-sequence modeling, a graph attention network (GAT) constructed from flow connectivity relations, and a modern log-analysis baseline based on sequential log representation learning. These baselines provide a more rigorous comparison against recent sequence, graph, and log-analysis methods. This repeated-run analysis supplements the point estimates reported in the main performance tables and evaluates statistical reliability using the full sequence-level test set of 8,233 samples, as described in Section 4.3.1.

Download:

• PNG
  larger image
• TIFF
  original image

Table 9. Repeated-run comparison with stronger baselines over five independent runs.

https://doi.org/10.1371/journal.pone.0357204.t009

The repeated-run results show that DSDAN maintains the highest mean accuracy, macro F1-score, and AUC with low standard deviation, indicating stable performance across random seeds. The paired t-test results show statistically significant improvements over all competing models at the p < 0.05 level. The Transformer encoder provides competitive performance, but it remains below DSDAN, which suggests that generic self-attention over flow sequences does not fully capture the complementary log-flow evidence used by the proposed framework. The GAT-based model also performs strongly but depends mainly on flow connectivity structure and does not directly model log reconstruction deviations. The sequential log-analysis baseline captures log behavior but lacks supervised flow-level attack evidence. These findings support the claim that the dual-stream design improves performance by jointly modeling log-level deviations and flow-level behavioral patterns.

To further evaluate robustness, we tested the models under two controlled perturbation settings: noisy log input and partial flow-feature masking. Table 10 reports the robustness results under noisy IoT logs and partial masking of network-flow features. In the noisy-log setting, random token noise was injected into 10% of IoT log entries. In the flow-masking setting, 10% of flow features were randomly masked during inference. The same perturbation settings were applied to all models.

Download:

• PNG
  larger image
• TIFF
  original image

Table 10. Robustness evaluation under noisy logs and masked flow features.

https://doi.org/10.1371/journal.pone.0357204.t010

The robustness results indicate that DSDAN experiences smaller performance degradation than the competing models under both perturbation settings. This behavior is consistent with the dual-stream design: when one modality is partially corrupted, the other modality can still provide complementary evidence for the final risk prediction. These results further support the reliability of the proposed fusion-based architecture under realistic noisy-input conditions.

4.3.1. Confusion matrix analysis.

Fig 3 presents the confusion matrix for the five-class classification problem using the full sequence-level test set of 8,233 samples. DSDAN correctly classifies 1,975 compliant cases, 1,322 policy-drift cases, 1,187 configuration-violation cases, 1,605 behavioral-anomaly cases, and 1,585 confirmed-attack cases. The total number of correct predictions is 7,674 out of 8,233 test sequences, which is consistent with the reported overall accuracy of 93.2%. Misclassifications remain concentrated between neighboring risk categories, indicating that most errors occur between semantically adjacent compliance-risk levels rather than across distant classes.

Download:

• PNG
  larger image
• TIFF
  original image

Fig 3. Confusion matrix for the five-class classification task evaluated on the full sequence-level test set of 8,233 samples.

https://doi.org/10.1371/journal.pone.0357204.g003

4.3.2. ROC and precision-recall analysis.

Fig 4 presents both the ROC curve and precision-recall (PR) curve for the critical high-risk category (Class 4), providing a comprehensive view of the model’s discriminative performance under a one-vs-rest evaluation protocol. Both curves were generated from the full set of Class 4 ground-truth labels and predicted Class 4 probabilities by sweeping all unique decision thresholds. No manually selected threshold points, sparse sampling, or interpolation-based smoothing was used.

Download:

• PNG
  larger image
• TIFF
  original image

Fig 4. Performance evaluation of DSDAN for the high-risk category (Class 4):

(a) ROC curve generated from one-vs-rest Class 4 scores, and (b) precision-recall curve generated by sweeping all unique Class 4 probability thresholds without sparse point sampling or interpolation.

https://doi.org/10.1371/journal.pone.0357204.g004

As shown in Fig 4(a), the DSDAN model achieves a steep rise in the ROC curve, reaching a true positive rate (TPR) above 0.90 at a low false positive rate (FPR), and approaching a TPR of 1.0 at higher thresholds. The area under the curve (AUC) for this class approaches 0.99, indicating strong separability between high-risk violations and other classes. Fig 4(b) shows the precision-recall trade-off for the same class. The model maintains high precision across most recall levels and shows the expected decline as recall approaches one, reflecting the inclusion of lower-confidence positive predictions at relaxed thresholds. The high PR-AUC supports the model’s ability to preserve precision while capturing most high-risk cases, which is important for auditing scenarios where false alerts increase analyst workload.

For operational decision-making, the classification threshold was selected using the validation set rather than the test set. For each risk category, predicted softmax scores were swept across candidate thresholds in the range [0,1], and the operating point was chosen by maximizing the validation F1-score while maintaining recall of at least 0.80 for high-risk violations. This criterion balances missed violation reduction with false-positive control, which is suitable for compliance auditing scenarios. After selection, the threshold was fixed and applied to the held-out test set for ROC, PR, and precision-at-recall evaluation.

4.3.3. Training dynamics and convergence analysis.

Fig 5 presents the training dynamics of the proposed DSDAN model, including loss convergence, accuracy progression, and learning rate adaptation across epochs. As shown in Fig 5(a), both training and validation loss decrease rapidly during the initial epochs, dropping from approximately 0.95 to below 0.3 within the first 10 epochs. The curves continue to decline and converge near 0.05 after epoch 30, with minimal divergence, indicating stable learning and strong generalization without overfitting.

Download:

• PNG
  larger image
• TIFF
  original image

Fig 5. Training dynamics of the DSDAN model:

(a) loss convergence showing stable optimization and minimal overfitting, (b) accuracy progression indicating strong generalization, and (c) learning rate decay supporting efficient and stable training.

https://doi.org/10.1371/journal.pone.0357204.g005

Fig 5(b) illustrates the corresponding accuracy trends. Both training and validation accuracy increase steadily from around 0.65 at initialization to above 0.95 by epoch 25. The curves eventually saturate near 0.99 for training and 0.98 for validation, demonstrating high predictive performance and balanced model fitting. The consistently small gap between the curves reflects effective regularization in the dual-stream architecture. Fig 5(c) shows the learning rate schedule used during training. The learning rate decreases smoothly from approximately 0.001 to 0.0002 over 50 epochs. This gradual decay supports rapid convergence in early stages and stable fine-tuning in later epochs, helping to prevent oscillations and improve final model performance.

4.3.4. Deployment-oriented and explainability assessment.

To support the practical interpretation of the proposed framework, we evaluated deployment feasibility through inference latency, memory usage, robustness under noisy inputs, and post-hoc explanation outputs. The full DSDAN model requires 3.1 ms per inference and 110 MB of memory, which indicates that the model is computationally feasible for near-real-time monitoring on workstation-class hardware. The robustness evaluation further shows that the model maintains stable macro F1-score under noisy log input and partial flow-feature masking, supporting its use in imperfect operational environments.

For explainability, each prediction is accompanied by diagnostic evidence from both streams. The IoT stream reports the reconstruction error as an indicator of log-level deviation, while the flow stream reports the most influential flow features using gradient-based attribution. The fusion layer also provides modality-level contribution scores, allowing the output to be interpreted as log-driven, flow-driven, or jointly supported. This explanation design provides actionable evidence for security analysts by linking the predicted risk class to the input modality and feature groups that most influenced the decision.

The deployment-oriented evaluation focuses on computational feasibility, robustness under controlled perturbations, and availability of interpretable diagnostic outputs. These findings support the use of DSDAN for pilot deployment studies and offline diagnostic analysis. Broader enterprise deployment can further incorporate site-specific policy mapping, organization-specific configuration records, and validation by domain analysts.