A Graph‐Based Bayesian Intrusion Detection Framework With <scp>No‐U‐Turn</scp> Sampling for Uncertainty‐Aware <scp>IoT</scp> Security

Abstract

ABSTRACT The growing scale and heterogeneity of the Internet of Things (IoT) have intensified the need for intrusion detection systems that are not only accurate but also reliable under uncertainty. This study proposes NUTSGRAPH, a graph‐based Bayesian intrusion detection framework that integrates relational traffic modeling with No‐U‐Turn Sampling (NUTS) for uncertainty‐aware IoT security. NetFlow traffic from the NF‐ToN‐IoT‐v3 dataset is transformed into a directed communication graph in which endpoints are represented as nodes and flows are represented as attributed edges. A GraphSAGE encoder learns topology‐aware node embeddings, which are fused with flow attributes to form edge‐level representations for downstream classification. To improve confidence reliability beyond deterministic and approximate Bayesian baselines, a compact Bayesian multilayer perceptron is applied to the frozen graph embeddings, with posterior inference performed using NUTS. Experimental results show that NUTSGRAPH achieved 0.968150 accuracy, 0.003843 expected calibration error, and 0.950017 OoD AUROC, indicating strong predictive performance, improved calibration, and competitive novelty‐sensitive behavior within the NF‐ToN‐IoT‐v3 benchmark setting. The findings suggest that coupling graph‐based relational learning with sampling‐based Bayesian posterior inference can support more dependable intrusion detection by producing predictions with better‐calibrated uncertainty estimates. Although the Bayesian stage introduces higher memory demand, likelihood subset sampling provides a practical mechanism for balancing posterior quality and computational feasibility. Overall, NUTSGRAPH offers a focused benchmark‐based demonstration of how graph‐based relational learning and sampling‐based Bayesian inference can be combined to support more trustworthy, uncertainty‐aware intrusion detection in dynamic IoT environments.