From Packet Traces to Contradiction Scores: A Neutrosophic
Signature Calculus for Real-Time IoT Intrusion Attribution
Rozina Ali1,∗
1Cairo University, Egypt
Email: rozyyy123n@gmail.com
Abstract
Real-time Internet of Things intrusion attribution is often formulated as direct multi-class classification, although
packet traces contain incomplete, conflicting, and imbalanced evidence. This paper develops a mathematical neutrosophic
signature calculus in which each flow is represented by truth, indeterminacy, and falsity memberships
over class-specific attack signatures. The proposed model constructs entropy-contrast behavioral channels, maps
each flow to class prototypes through a contradiction-aware single-valued neutrosophic transformation, and derives
a closed-form attribution rule by coupling prototype truth, opposite-region falsity pressure, and explicit indeterminacy
penalization. The study uses RT-IoT2022, a public UCI benchmark donated in 2024 with 123,117 flows, 83
features, and 12 normal/attack labels. The results show that the proposed calculus provides interpretable class attribution
and stable macro-level behavior under severe class imbalance. The work supports neutrosophic signature
modeling as a transparent route for IoT security decision support under inconsistent network evidence.
Keywords: Single-valued neutrosophic set; Intrusion attribution; IoT security; Contradiction score;
Uncertainty-aware classification; Information fusion