A multi-stage framework for scalable and context-aware intrusion detection in IoT-cloud systems using deep latent modeling and graph-based attack classification

The rapid proliferation of Internet of Things (IoT) devices in cloud environments has led to an expanded attack surface and increased susceptibility to diverse and evolving cyber threats. This study proposes a robust, multi-stage hybrid intrusion detection framework designed to address the challenges of high-dimensional data, class imbalance, and dynamic traffic in IoT ecosystems. The framework integrates Variational AutoEncoder (VAE) for latent feature compression, Isolation Forest (IF) for unsupervised anomaly detection, and Graph Attention Network (GAT) for relational modeling and multi-class classification. The CIC IoT-DIAD 2024 dataset is utilized to evaluate performance across multiple attack categories. The VAE extracts compact latent representations, enabling effective anomaly detection through IF. Detected anomalies are then structured into graph topologies, and classified by GAT based on node-level features and inter-node relations. Experimental results demonstrate superior detection performance with an overall accuracy of 99.08% and an F1-score of 98.03%, outperforming traditional and deep learning baselines. The proposed system exhibits strong scalability, generalization, and adaptability to dynamic IoT-cloud threat landscapes. Furthermore, its graph-based reasoning enhances interpretability and supports actionable insights for real-time threat response. Overall, this framework establishes a practical pathway toward intelligent, adaptive, and interpretable intrusion diagnosis in next-generation IoT-cloud ecosystems.