Abstract
Abstract: Existing IoT anomaly detection studies have achieved high classification performance, but most focus on accuracy and F1-score without explicitly controlling the false positive rate (FPR). In addition, many approaches rely on a single detection perspective, limiting their operational reliability. To address this gap, this study proposes a hybrid anomaly detection framework integrating Long Short-Term Memory (LSTM), Shannon entropy, and autoencoder reconstruction error. Shannon entropy is incorporated as an additional feature, while LSTM and the autoencoder capture temporal and reconstruction characteristics. The resulting hybrid representation is processed by a constraint-based threshold selection mechanism that enforces FPR . Experiments on the TON-IoT and Edge-IIoTset datasets achieved average F1-scores of 0.9250 and 0.9934, while maintaining average FPR values of 0.0091 and 0.0714, respectively. Analysis of entropy distributions showed consistent differences between normal and anomalous traffic across both datasets, indicating that Shannon entropy provides discriminative information for anomaly detection. These results demonstrate strong detection performance with controlled false alarms, while ablation studies confirm the significant contribution of Shannon entropy to overall model performance. Keywords: false positive rate; hybrid deep learning; Internet of Things; network anomaly detection; Shannon entropy Abstrak: Penelitian deteksi anomali Internet of Things (IoT) telah menunjukkan performa klasifikasi yang tinggi, namun sebagian besar masih berfokus pada accuracy dan F1-score tanpa mengendalikan false positive rate (FPR) secara eksplisit. Selain itu, banyak pendekatan hanya memanfaatkan satu perspektif deteksi sehingga reliabilitas operasionalnya masih terbatas. Untuk mengatasi kesenjangan tersebut, penelitian ini mengusulkan kerangka deteksi anomali hybrid yang mengintegrasikan Long Short-Term Memory (LSTM), Shannon entropy, dan autoencoder reconstruction error. Shannon entropy digunakan sebagai fitur tambahan, sedangkan LSTM dan autoencoder menangkap karakteristik temporal dan deviasi rekonstruksi. Representasi hybrid yang dihasilkan kemudian diproses melalui mekanisme constraint-based threshold selection dengan batas FPR . Hasil pengujian pada dataset TON-IoT dan Edge-IIoTset menghasilkan F1-score rata-rata sebesar 0,9250 dan 0,9934, dengan FPR rata-rata sebesar 0,0091 dan 0,0714. Perbedaan nilai entropy yang konsisten antara trafik normal dan anomali pada kedua dataset menunjukkan bahwa Shannon entropy menyediakan informasi diskriminatif untuk deteksi anomali. Hasil tersebut menunjukkan performa deteksi yang kuat dengan false alarm yang terkendali, sementara studi ablasi mengonfirmasi kontribusi signifikan Shannon entropy terhadap performa model. Kata kunci: deteksi anomali jaringan; false positive rate; hybrid deep learning; Internet of Things; Shannon entropy