An Attention-Based CNN–LSTM Deep Learning Framework for Intelligent Network Intrusion Detection in IoT Environments

Abstract

With an increasing number of Internet of Things (IoT) devices coming online, there has been a rapid increase in the attack surface of the networks. For such modern IoT security architectures, automatic and intelligent intrusion detection is essential. Traditional signature-based Network Intrusion Detection Systems (NIDS) have been proven ineffective due to the inability to adapt to new and disguised attack patterns. An Attention-Based Convolutional Neural Network–Long Short-Term Memory (Attention CNN-LSTM) model was suggested, which combined one-dimensional convolutional feature extraction, two-directional LSTM modeling and multi-headed self-attention reweighting into one end-to-end framework. The experiment was done using CICIDS2017 benchmark dataset, which included 2.8 million labeled records and 15 traffic types. The feature set was reduced from 78 to 40 by using Mutual Information method. The Attention CNN-LSTM model reached the accuracy of 99.96%, F1 score of 99.96%, MCC of 0.9992, and Cohen's Kappa of 0.9992 and surpassed the standalone CNN (99.94%), LSTM (99.56%), RNN (56.98%), and hybrid CNN-LSTM (99.95%) models on all metrics. The binary classification pilot experiment gave 19,404 true negative predictions, 25,563 true positive predictions, 15 false positives and 161 false negatives on 45,143 examples. Latency time of each prediction was 0.195 ms and showed the possibility of deploying the model in real-time IoT edge. Attention weights visualization gave additional interpretability regarding the selective importance of certain features for minority attack classes like Web Attack or Infiltration, which are not presented enough in conventional benchmark datasets.