DSDAN: A Dual-Stream Multimodal Log-Flow Fusion Framework for Network Configuration Auditing and Compliance-Risk Detection.

Abstract

The increasing complexity of modern networks, particularly in IoT and distributed cloud environments, poses significant challenges for maintaining configuration integrity and compliance. Existing solutions for network auditing rely heavily on static rules or manual scripting, which fail to scale or adapt to dynamic network conditions. In this work, we propose a novel AI-driven framework, the Dual-Stream Deep Auditing Network (DSDAN), that leverages deep learning to automate configuration auditing and detect policy violations. DSDAN integrates structured network flow features and unstructured device logs through parallel encoder-decoder streams, enabling joint representation learning for robust compliance analysis. For evaluation, we combine IoT Device Network Logs and UNSW-NB15 because they represent two complementary evidence channels used in practical network auditing: device-level operational logs and flow-level behavioral security records. IoT logs support reconstruction-based identification of abnormal device or configuration behavior, while UNSW-NB15 provides labeled network-flow patterns for modeling unauthorized, anomalous, and attack-like activity. Using these complementary sources, DSDAN achieves an overall accuracy of 93.2%, macro F1-score of 0.918, and micro F1-score of 0.927, surpassing baseline models. The model further records an AUC of 0.957, PR-AUC of 0.948, and the lowest IoT log reconstruction error (MSE = 0.031, MAE = 0.020). Despite its dual-stream architecture, DSDAN maintains efficient inference with a latency of 3.1 ms and memory footprint of 110 MB. These results validate the effectiveness of our approach in identifying subtle misconfigurations and unauthorized behaviors often missed by traditional tools.