HybridGuard: A Graph-Temporal Fusion Architecture for Real-Time IoT Intrusion Detection on Identity-Less Flow Data

This work makes two contributions to graph-based intrusion detection for identity-less IoT flow data. First, it introduces a proxy session graph construction method that enables relational modeling on datasets like CIC-IoT-2023, where conventional endpoint-identity-based graphs (IP/MAC) cannot be built. Second, through rigorous multi-seed statistical validation, it demonstrates that graph structure alone is insufficient in this setting — the GNN-only variant underperforms a simple tabular baseline on both tasks — while a gated fusion of spatial (GAT) and temporal (Transformer) representations yields a statistically significant improvement over Random Forest on binary detection (p = 0.0001), with real-time-feasible latency (3.66 ms/window). This finding reframes the value proposition of graph-based IDS: not as a standalone improvement, but as a component that becomes effective only when fused with temporal modeling.