DSDAN: A Dual-Stream Multimodal Log-Flow Fusion Framework for Network Configuration Auditing and Compliance-Risk Detection
5 affiliations
- 1Information Science, Trine University, Allen Park, Michigan, United States of America
- 2Washington University of Science and Technology, Eisenhower Ave, Alexandria, Virginia, United States of America
- 3School of Business, International American University, Los Angeles, California, United States of America
- 4Information Technology, St. Francis College, Brooklyn, NewYork, United States of America
- 5Jahangirnagar University, Savar, Dhaka, Bangladesh
Abstract
The increasing complexity of modern networks, particularly in IoT and distributed cloud environments, poses significant challenges for maintaining configuration integrity and compliance. Existing solutions for network auditing rely heavily on static rules or manual scripting, which fail to scale or adapt to dynamic network conditions. In this work, we propose a novel AI-driven framework, the Dual-Stream Deep Auditing Network (DSDAN), that leverages deep learning to automate configuration auditing and detect policy violations. DSDAN integrates structured network flow features and unstructured device logs through parallel encoder-decoder streams, enabling joint representation learning for robust compliance analysis. For evaluation, we combine IoT Device Network Logs and UNSW-NB15 because they represent two complementary evidence channels used in practical network auditing: device-level operational logs and flow-level behavioral security records. IoT logs support reconstruction-based identification of abnormal device or configuration behavior, while UNSW-NB15 provides labeled network-flow patterns for modeling unauthorized, anomalous, and attack-like activity. Using these complementary sources, DSDAN achieves an overall accuracy of 93.2%, macro F1-score of 0.918, and micro F1-score of 0.927, surpassing baseline models. The model further records an AUC of 0.957, PR-AUC of 0.948, and the lowest IoT log reconstruction error (MSE = 0.031, MAE = 0.020). Despite its dual-stream architecture, DSDAN maintains efficient inference with a latency of 3.1 ms and memory footprint of 110 MB. These results validate the effectiveness of our approach in identifying subtle misconfigurations and unauthorized behaviors often missed by traditional tools.
Related
- A Multimodal Machine Learning Framework Integrating Genomic, Epidemiological, Environmental, and Clinical Imaging Data for Accelerated Measles Detection and Transmission Inference
- Integrated Predictive and Remote-Sensing Framework for Early Warning and Regulatory Compliance in Environmentally Sensitive Urban Zones
- Research on multimodal dense small object detection algorithms guided by cross-modal information
- An interpretable multimodal deep learning model for physiological stress detection
- Validation of video-based event detection against laboratory-standard biomechanical measures: a synchronized multimodal study
BibTeX
@article{javeed2026dsdan,
title = {{DSDAN: A Dual-Stream Multimodal Log-Flow Fusion Framework for Network Configuration Auditing and Compliance-Risk Detection}},
author = {Mohammed Saad Javeed and MD Al Rafi and Arifur Rahman and Hashibul Ahsan Shoaib and Sheikh Razia Sultana},
journal = {PLOS One},
year = {2026},
month = sep,
doi = {10.1371/journal.pone.0357204},
url = {https://doi.org/10.1371/journal.pone.0357204},
note = {CC BY 4.0},
}
RIS
TY - JOUR
TI - DSDAN: A Dual-Stream Multimodal Log-Flow Fusion Framework for Network Configuration Auditing and Compliance-Risk Detection
AU - Mohammed Saad Javeed
AU - MD Al Rafi
AU - Arifur Rahman
AU - Hashibul Ahsan Shoaib
AU - Sheikh Razia Sultana
PY - 2026
DA - 2026/09/08
JO - PLOS One
DO - 10.1371/journal.pone.0357204
UR - https://doi.org/10.1371/journal.pone.0357204
AB - The increasing complexity of modern networks, particularly in IoT and distributed cloud environments, poses significant challenges for maintaining configuration integrity and compliance. Existing solutions for network auditing rely heavily on static rules or manual scripting, which fail to scale or adapt to dynamic network conditions. In this work, we propose a novel AI-driven framework, the Dual-Stream Deep Auditing Network (DSDAN), that leverages deep learning to automate configuration auditing and detect policy violations. DSDAN integrates structured network flow features and unstructured device logs through parallel encoder-decoder streams, enabling joint representation learning for robust compliance analysis. For evaluation, we combine IoT Device Network Logs and UNSW-NB15 because they represent two complementary evidence channels used in practical network auditing: device-level operational logs and flow-level behavioral security records. IoT logs support reconstruction-based identification of abnormal device or configuration behavior, while UNSW-NB15 provides labeled network-flow patterns for modeling unauthorized, anomalous, and attack-like activity. Using these complementary sources, DSDAN achieves an overall accuracy of 93.2%, macro F1-score of 0.918, and micro F1-score of 0.927, surpassing baseline models. The model further records an AUC of 0.957, PR-AUC of 0.948, and the lowest IoT log reconstruction error (MSE = 0.031, MAE = 0.020). Despite its dual-stream architecture, DSDAN maintains efficient inference with a latency of 3.1 ms and memory footprint of 110 MB. These results validate the effectiveness of our approach in identifying subtle misconfigurations and unauthorized behaviors often missed by traditional tools.
SN - 1932-6203
ER -