KAN-LSTM: Benchmarking Kolmogorov-Arnold Networks for Cyber Security Threat Detection in IoT Networks

1. Problem Statement

Cyber threat detection in IoT and network environments faces significant challenges due to:

• Data Complexity: Network traffic data involves complex spatial and temporal dependencies that traditional models struggle to capture simultaneously.
• Limitations of MLPs: Multi-Layer Perceptrons (MLPs) use fixed activation functions and linear weights, making them less efficient at approximating complex nonlinear functions in high-dimensional data.
• Scalability and Imbalance: Existing deep learning models (CNNs, LSTMs) often struggle with dataset imbalance (rare attack types) and scalability, leading to high false positives or missed detections.
• Lack of KAN Benchmarking: While Kolmogorov-Arnold Networks (KANs) have shown promise in other domains, their specific efficacy in cyber security and intrusion detection (IDS) had not been formally assessed or benchmarked against state-of-the-art deep learning models.

2. Methodology

The authors propose a hybrid architecture called KAN-LSTM and conduct a comprehensive benchmarking study.

A. Theoretical Foundation: Kolmogorov-Arnold Networks (KANs)

Unlike traditional MLPs where weights are learned and activation functions are fixed, KANs are based on the Kolmogorov-Arnold Representation Theorem.

• Mechanism: KANs replace fixed activation functions with learnable univariate functions (parameterized as B-splines) located on the edges of the network graph.
• Advantage: This allows the network to dynamically learn activation patterns, offering better function approximation with fewer parameters and higher interpretability.

B. Proposed Architecture: KAN-LSTM

The proposed model is a three-stage hybrid designed to capture both local spatial features and long-range temporal dependencies:

1. Convolutional Neural Network (CNN) Layer:
   • Two CNN layers are used to encode local feature dependencies.
   • Input data (1D traffic flows) is transformed into 2D tensors to leverage CNN capabilities for spatial pattern extraction.
2. Long Short-Term Memory (LSTM) Layer:
   • A single LSTM layer processes the CNN output to capture temporal and sequential dependencies in the network traffic.
   • This addresses the vanishing gradient problem and retains learned key points over time.
3. KAN Layer:
   • The LSTM output is fed into a KAN layer to model nonlinear high-dimensional mappings.
   • This stage performs adaptive feature extraction using learnable spline functions to classify the traffic.
4. Output: A binary classifier using Binary Cross-Entropy (BCE) loss.

C. Experimental Setup

• Datasets: The study utilizes four datasets to ensure robustness and diversity:
  1. UNSW-NB15: Hybrid real/simulated traffic (49 features).
  2. NSL-KDD: Enhanced version of KDD Cup 99 (41 features).
  3. CICIDS2017: Realistic traffic with diverse attacks (80 features).
  4. Tri-IDS (Novel Contribution): A new, large-scale combined dataset merging BOT-IoT, NSL-KDD, and CICIDS2017 (120 features, ~76.5M rows) to create a balanced, unbiased benchmark with diverse traffic patterns.
• Baselines: The proposed model is compared against CNN, LSTM, MLP (2 and 5 layers), standard KANs, and ConvKAN.
• Metrics: Accuracy, Precision, Recall, and F1-Score.

3. Key Contributions

1. First KAN Benchmark in Cyber Security: This is the first study to systematically evaluate KANs for intrusion detection, demonstrating their superiority over traditional MLPs in terms of accuracy and parameter efficiency.
2. Hybrid KAN-LSTM Model: The introduction of a novel architecture that synergizes the spatial feature extraction of CNNs, the temporal modeling of LSTMs, and the adaptive function approximation of KANs.
3. Tri-IDS Dataset: The creation and release of a massive, combined dataset (Tri-IDS) to address data imbalance and provide a rigorous, large-scale benchmark for future research.
4. Comprehensive Evaluation: Extensive testing across four distinct datasets, proving the model's generalization capabilities across different traffic patterns and attack types.

4. Results

The KAN-LSTM model consistently outperformed all baseline models (CNN, LSTM, MLP, ConvKAN, and standalone KANs) across all four datasets.

• UNSW-NB15: KAN-LSTM achieved 95.89% Accuracy, surpassing the next best (KANs(5) at 94.45%) and significantly outperforming baselines in Precision (94.50%) and F1-Score (94.01%).
• NSL-KDD: Achieved 94.05% Accuracy and an F1-Score of 94.35, with a notable Precision of 98.95%.
• CICIDS2017: Demonstrated exceptional performance with 99.28% Accuracy and an F1-Score of 99.66, showing a 5% improvement over the closest variant.
• Tri-IDS: On the massive combined dataset, KAN-LSTM achieved 93.76% Accuracy and 93.39% F1-Score, proving robustness against highly imbalanced and diverse traffic patterns.

Key Observations:

• KAN-based models generally outperformed traditional MLPs and CNNs, particularly in handling class imbalance (higher Recall and Precision).
• The hybrid KAN-LSTM architecture successfully mitigated the limitations of individual components, balancing local and non-local relationship encoding.

5. Significance and Conclusion

• Paradigm Shift: The study validates KANs as a viable and superior alternative to traditional deep learning architectures for cyber security, offering a new direction for adaptive defensive models.
• Efficiency: KANs achieve higher accuracy with significantly fewer learnable parameters compared to MLPs, suggesting potential for deployment in resource-constrained IoT environments.
• Robustness: The proposed KAN-LSTM model demonstrates resilience to dataset imbalance and bias, a critical requirement for real-world intrusion detection systems where attacks are rare events.
• Future Work: The authors acknowledge current limitations of KANs, such as slow processing speeds and training costs, and call for future research to optimize scalability and efficiency for real-time cyber defense applications.

In summary, this paper establishes KAN-LSTM as a state-of-the-art solution for IoT threat detection, leveraging the mathematical advantages of Kolmogorov-Arnold Networks to overcome the structural limitations of traditional neural networks in complex security environments.