【摘要】 物联网恶意流量检测面临高维非平衡数据处理，攻击行为时空关联建模及边缘部署适配等挑战。现有方法在特征提取完整性、长程攻击关联性及分类边界优化方面存在局限。为此，提出多阶段协同预处理框架与深度时空融合检测模型，通过三级威胁映射将43类攻击归并为6类高阶威胁，采用合成少数类过采样技术(synthetic minority oversampling technique, SMOTE)优化数据分布，构建基于残差注意力机制的时空联合感知网络，设计动态可调节分类头模块实现自适应权重调整。在CIC IoT dataset2023数据集上的实验表明，该方法综合检测精度达到97.10%,F1-score较传统长短期记忆网络(long short-term memory, LSTM)提升5.58个百分点。验证实验显示其对加密流量解析和低频攻击检测具有性能优势，模型参数量压缩显著，满足边缘计算环境部署需求。更多还原

【Abstract】 The internet of things(IoT) malicious traffic detection faces challenges such as high-dimensional imbalanced data processing, spatio-temporal correlation modeling of attack behaviors, and edge deployment adaptation. Existing methods exhibit limitations in feature extraction completeness, long-range attack correlation modeling, and classification boundary optimization. To address these challenges, this paper proposes a multi-stage collaborative preprocessing framework and a deep spatio-temporal fusion detection model. A three-level threat mapping is employed to merge 43 attack types into 6 high-level threats. Data distribution is optimized by using the synthetic minority oversampling Technique(SMOTE). A spatio-temporal joint perception network is built based on a residual attention mechanism. A dynamically adjustable classification head module is designed for adaptive weight adjustment. Experiments on the CIC IoT Dataset 2023 show the method achieves an overall detection accuracy of 97.10%, with the F1-score improving by 5.58 percentage points compared with traditional long short-term memory models(LSTM). Validation experiments demonstrate it outperforms in encrypted traffic analysis and low-frequency attack detection, along with significant model parameter compression, meeting the deployment requirements of edge computing environments.更多还原