IoT-GRAF: IoT Graph Learning-Based Anomaly and Intrusion Detection Through Multi-Modal Data Fusion

In the current technological landscape, Internet of Things (IoT) systems are deeply embedded in numerous facets of daily life, from domestic settings to critical infrastructure, which underscores the importance of these systems security and integrity. The constrained nature of IoT devices, in terms of computational capacity, economic limitations, or time-to-market, makes them vulnerable to security breaches and system failures. Additionally, the hybrid essence of IoT- combining the physical domain via sensor interfaces and the cyber domain through communication networks and cloud connectivity- further complicates mitigating these threats. While numerous techniques for either network intrusion detection or sensor anomaly detection exist, an integrated approach that synergistically combines information from both domains is absent. This paper proposes a multi-modal data fusion technique, which, for the first time, melds sensor and communication data. This approach underscores the interdependencies between the components, provides contextual embeddings for data from each element, and integrates the system's physical and cyber features into a graph-based representation. Harnessing the power of Graph Neural Networks (GNNs), we capture the normal state and context of the system, facilitating the detection of anomalies and intrusions. Additionally, our model discerns between network and sensor-based attacks, pinpointing the anomaly's origin, thereby expediting post-incident recovery. Optimized for fog-computing environments, our solution ensures real-time oversight. Rigorous testing on greenhouse IoT systems indicates the efficacy of our model, with a commendable 22% improvement in Fl-score over singular modal techniques.