The rapid growth of Internet of Things devices has intensified cybersecurity threats, necessitating efficient and lightweight intrusion detection systems. Current methods struggle with computational efficiency and feature coverage, particularly for long time-series attack patterns in resource-constrained environments. This study introduces GNN-CST, a novel dual-flow network architecture combining graph neural networks and convolutional neural networks to address these challenges. We developed GNN-CST, integrating a CNN branch to extract local temporal features from traffic data, a GNN branch to model topological interactions among IoT devices, and an adaptive sparse attention mechanism to dynamically focus on critical temporal windows. This design enhances detection of bursty attacks while reducing computational overhead. A cross-modal fusion layer combines local and global features for robust decision-making. GNN-CST exhibits strong performance across six datasets—Edge-IIoT, UNSW-NB15, CICIDS2017, CICIDS2018, BoT-IoT, and ToN-IoT—achieving detection accuracies of 99.46%, 93.50%, 99.84%, 99.78%, 99.99%, and 99.95%, respectively. The average single-epoch training time is 180 s, with a training loss of 0.032, surpassing the baseline Transformer and other models. Compared to the baseline CST model, GNN-CST improves accuracy on multiple datasets and reduces training time by 18%. This study offers an efficient solution for multimodal threat detection in IoT environments.