LNNIDS: A Hybrid Liquid Neural Network based IDS for Known and Unknown IoT Attacks

Abstract

The rapid expansion of Internet of Things (IoT) networks has introduced new cybersecurity risks, particularly due to their heterogeneous, dynamic, and resource-constrained nature. Intrusion Detection Systems (IDS) are commonly used to detect cyber threats in such environments, but traditional IDSs and many machine learning (ML) or deep learning (DL)-based methods face challenges. These include poor detection of unknown attacks, dependence on large datasets, static feature learning, and an inability to adapt to evolving traffic patterns without frequent retraining. Furthermore, while graph-based IDSs capture relational context, their high computational cost and difficulty in adapting to dynamic IoT networks hinder their scalability. To address these challenges, we propose LNNIDS, a novel IDS method that integrates spike encoding with a Hybrid Liquid Neural Network (HLLN) to capture the temporal evolution of IoT attack network traffic. To further enhance accuracy, we introduce DYNGrapℎ, a dynamic graph-based method that performs n → 1 pattern clustering for scalable attack classification. This allows the LNNIDS to dynamically group related flow behaviors and adapt to new or unknown attacks without retraining. We evaluated LNNIDS on two public IoT datasets. This method achieved 99.50% accuracy and maintained robust performance with only 20% training data. Furthermore, we compared the LNNIDS with the seven recent state-of-the-art methods, and we found that LNNIDS outperformed them in the detection of known and unknown IoT attacks with 13.45% and 11.99% better accuracy, respectively. © 2025 Copyright held by the owner/author(s)