As Internet of Things (IoT) technologies continue to evolve and gain widespread integration across various sectors, IoT devices have become increasingly interconnected and ubiquitous. However, this surge has also led to more sophisticated, diverse, and covert attacks, posing severe security challenges to IoT ecosystems and their defense mechanisms. Intrusion Detection Systems (IDS) are instrumental in securing the IoT by uncovering and mitigating malicious behaviors in real-time. Nevertheless, the growing complexity of network traffic presents significant challenges for IDS, often resulting in a higher false alarm rate and a lower detection rate, due to the intricate characteristics of space and notable temporal dependencies present in network traffic. We conduct an in-depth dimensionality reduction analysis using the t-distributed Stochastic Neighbor Embedding methodology to examine the relationships among attack examples. Then, to enhance the generalization and robustness of IDS, we propose GBFKAN, a novel interpretable three-layer network architecture. The structured design of GBFKAN can comprehensively extract and perceive key information from multiple abstract levels in the raw traffic, enhancing the architecture’s generalization ability and robustness. Furthermore, we utilize the SHapley Additive ExPlanations method to provide detailed explanations of the detection outcomes, augmenting its credibility. Building on this, we successfully identify the erroneous decision-making paradigms within GBFKAN by incorporating empirical knowledge. Extensive simulation experiments conducted on the four widely recognized intrusion detection datasets have conclusively demonstrated that our proposed GBFKAN model surpasses existing methods in terms of intrusion detection performance.

Hyperbolic embeddings excel in encoding hierarchical data, while Euclidean embeddings are more adept at capturing complex semantic relationships through rotation operations. However, advanced Euclidean embedding models face the problem of high dimensionality, while advanced hyperbolic embedding models struggle to accommodate multiple relations and different semantics. To address this problem, we introduce LMH-PKE, a novel model that leverages the Poincaré to embed the hierarchical structure of the relationship graph data. It captures rich semantic relationships in Euclidean and models multiple relations using learnable entity decision boundary parameters. By transforming entities embedded in hyperbolic through Möbius matrix vector multiplication and Möbius addition, and encoding multiple relations in Euclidean space using cosine functions, Our experiments demonstrate that LMH-PKE achieves state-of-the-art results in hyperbolic embedding models while maintaining low dimensional simplicity.

Recently proposed scalable on-demand streaming protocols have previously been evaluated using a system cost measure termed the "required server bandwidth". For the scalable protocols that provide immediate service to each client when the server is not overloaded, this paper develops simple analytic models to evaluate two client-oriented quality of service metrics, namely (1) the mean client waiting time in systems where clients are willing to wait if a (well-provisioned) server is temporarily overloaded, and (2) the fraction of clients who balk (i.e., leave without receiving their requested media content) in systems where the clients will tolerate no or only very low service delays during a temporary overload. The models include novel approximate MVA techniques that appear to extend the range of applicability of customized AMVA to include questions focussed on state probabilities rather than on mean values, and to systems in which the operating points of interest do not include substantial client queues. For example, the new AMVA models accurately estimate the server bandwidth needed to achieve a balking rate as low as one in ten thousand. The analytic models can easily be applied to determine the server bandwidth needed for a given number of media files, anticipated total client request rate and file access frequencies, and target balking rate or mean wait. Results show that (a) scalable media servers that are configured with the "required server bandwidth" defined in previous work have low mean wait but may have unacceptably high client balking rates (i.e., greater than one in twenty), (b) for high to moderate client load, only a 10 - 50% increase in the previously defined required server bandwidth is needed to achieve a very low balking rate (e.g., one in ten thousand), and (c) media server performance (either mean wait or balking rate) degrades rapidly if the actual client load is more than 10% greater than the anticipated load.