Hierarchical Temporal Evidence Fusion for Intrusion Detection in Edge-Fog-Cloud IoT Architectures

Abstract

: The hierarchical and heterogeneous nature of Internet of Things (IoT) architectures, spanning edge, fog, and cloud layers, makes intrusion detection particularly challenging, as each layer provides only a partial view of the system. Traditional intrusion detection systems (IDS) often fail to identify coordinated and distributed attacks from fragmented observations. This paper proposes HTEF-IDS, a hierarchical intrusion detection framework that combines LSTM-based temporal modeling with Dempster–Shafer evidence fusion to infer a global security state from distributed observations. Local detections are progressively aggregated across layers, while a feedback mechanism dynamically adjusts detection sensitivity according to the inferred threat level. Experiments conducted on the CIC IoT-DIAD 2024 dataset show that the proposed framework improves detection performance, reduces false positives, and effectively identifies distributed attack patterns that are not observable at a single layer.