KAN-LSTM: Benchmarking Kolmogorov-Arnold Networks for Cyber Security Threat Detection in IoT Networks

2026-03-30

AI Summary

This study addresses the limitations of conventional threat detection models in IoT networks—namely, excessive parameter redundancy and poor generalization—by introducing Kolmogorov-Arnold Networks (KAN) to the cybersecurity domain for the first time. The authors propose a novel KAN-LSTM hybrid architecture that replaces traditional linear weights with learnable spline-based activation functions to dynamically capture spatiotemporal patterns in network traffic. Furthermore, they construct a large-scale, unbiased, multi-source fused benchmark dataset specifically designed for IoT threat detection. Experimental results demonstrate that the proposed model achieves superior detection accuracy compared to state-of-the-art deep learning approaches across multiple datasets—including UNSW-NB15, NSL-KDD, CICIDS2017, and a newly curated hybrid dataset—while significantly reducing the number of model parameters.

Technology Category

Application Domains: Internet of Things, Sensor Networks & Smart CitiesMachine Learning: Learning on the Edge & Model CompressionData Mining & Knowledge Management: Anomaly/Outlier Detection

Application Category

Graph Algorithms and Modeling for the Web: Graph neural networks and deep learning approaches for Web-related graphsSystems and Infrastructure for Web, Mobile and WoT: Applied ML and AI for Web-based mobile applicationsUser Modeling, Personalization and Recommendation: Attacks and countermeasures in recommendation systems

Abstract

By utilising their adaptive activation functions, Kolmogorov-Arnold Networks (KANs) can be applied in a novel way for the diverse machine learning tasks, including cyber threat detection. KANs substitute conventional linear weights with spline-parametrized univariate functions, which allows them to learn activation patterns dynamically, inspired by the Kolmogorov-Arnold representation theorem. In a network traffic data, we show that KANs perform better than traditional Multi-Layer Perceptrons (MLPs), yielding more accurate results with a significantly less number of learnable parameters. We also propose KAN-LSTM model to combine advantages of spatial and temporal encoding. The suggested methodology highlights the potential of KANs as an effective tool in detecting cyber threats and offers up new directions for adaptive defensive models. Lastly, we conducted experiments on three main dataset, UNSW-NB15, NSL-KDD, and CICID2017, as well as we developed a new dataset combined from IOT-BOT, NSL-KDD, and CICID2017 to present a stable, unbiased, large-scale dataset with diverse traffic patterns. The results show the superiority of KAN-LSTM and then KAN models over the traditional deep learning models. The source code is available at GitHub repository

Problem

• Cyber Security
• Threat Detection
• IoT Networks
• Kolmogorov-Arnold Networks
• Network Traffic

Innovation

• Kolmogorov-Arnold Networks
• KAN-LSTM
• adaptive activation functions
• cyber threat detection
• IoT security