Decoupled Graph Anomaly Detection for IoT Security: A Disentangled Learning Framework

Internet of Things (IoT) devices face dual-natured security threats where compromised nodes exhibit both structural irregularities (unauthorized connections) and behavioral anomalies (abnormal traffic patterns). Existing graph neural network (GNN) detectors fail to address two critical issues. First, representation contamination: malicious nodes distort benign neighbors’ embeddings through message passing, leading to 34% false positives on adjacent clean devices in standard GCN approaches. Second, objective interference: unified loss functions cause gradient conflicts between topology and attribute anomaly objectives, reducing detection performance on mixed-attack scenarios. We propose DGAD (Disentangled Graph Anomaly Detection), a dual-decoupled framework addressing both issues. While the decoupling principle is general, DGAD is deliberately instantiated for IoT security, where compromised devices actively inject malicious traffic, device graphs are constructed from time-windowed communication flows, and mixed structural–behavioral attacks dominate. DGAD employs (1) an ego encoder for contamination-free representation learning (I(hie;N(i))=0) and a graph encoder for relational context, fused via correlation-guided weighting, and (2) independent topology-contrastive and attribute-reconstruction modules to eliminate gradient interference. Experiments on three IoT datasets (Bot-IoT, IoT-23, Smart Home) demonstrate that DGAD achieves 94.7% AUROC, surpassing the best baseline by 3.5% AUROC and 10.9% AUPRC, while reducing false positives to 8%. Edge deployment on a Raspberry Pi 4 confirms practicality with real-time inference (187 ms on GPU; 3.2 s on the Raspberry Pi 4) and 52 MB memory usage, making DGAD suitable for real-world IoT gateways.