Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Adaptive Cyber-Attack Detection in IIoT Using Attention-Based LSTM-CNN Models

Afrah Gueriani, Hamza Kheddar, Ahmed Cherif Mazari

TL;DR

This work tackles IIoT intrusion detection by introducing an attention-enhanced LSTM-CNN architecture evaluated on the Edge-IIoTset dataset. It addresses class imbalance with SMOTE and demonstrates superior binary and multiclass detection performance, achieving near-perfect binary accuracy and 99.04% multiclass accuracy with a 0.0220 loss. The approach combines temporal modeling (LSTM), spatial feature extraction (CNN), and an attention mechanism to focus on salient patterns, delivering fast inference suitable for real-time IDS. The findings highlight the method's practicality for securing industrial environments and outline avenues for transfer learning, lightweight deployment, and privacy-preserving extensions.

Abstract

The rapid expansion of the industrial Internet of things (IIoT) has introduced new challenges in securing critical infrastructures against sophisticated cyberthreats. This study presents the development and evaluation of an advanced Intrusion detection (IDS) based on a hybrid LSTM-convolution neural network (CNN)-Attention architecture, specifically designed to detect and classify cyberattacks in IIoT environments. The research focuses on two key classification tasks: binary and multi-class classification. The proposed models was rigorously tested using the Edge-IIoTset dataset. To mitigate the class imbalance in the dataset, the synthetic minority over-sampling technique (SMOTE) was employed to generate synthetic samples for the underrepresented classes. This ensured that the model could learn effectively from all classes, thereby improving the overall classification performance. Through systematic experimentation, various deep learning (DL) models were compared, ultimately demonstrating that the LSTM-CNN-Attention model consistently outperformed others across key performance metrics. In binary classification, the model achieved near-perfect accuracy, while in multi-class classification, it maintained a high accuracy level (99.04%), effectively categorizing different attack types with a loss value of 0.0220%.

Adaptive Cyber-Attack Detection in IIoT Using Attention-Based LSTM-CNN Models

TL;DR

This work tackles IIoT intrusion detection by introducing an attention-enhanced LSTM-CNN architecture evaluated on the Edge-IIoTset dataset. It addresses class imbalance with SMOTE and demonstrates superior binary and multiclass detection performance, achieving near-perfect binary accuracy and 99.04% multiclass accuracy with a 0.0220 loss. The approach combines temporal modeling (LSTM), spatial feature extraction (CNN), and an attention mechanism to focus on salient patterns, delivering fast inference suitable for real-time IDS. The findings highlight the method's practicality for securing industrial environments and outline avenues for transfer learning, lightweight deployment, and privacy-preserving extensions.

Abstract

The rapid expansion of the industrial Internet of things (IIoT) has introduced new challenges in securing critical infrastructures against sophisticated cyberthreats. This study presents the development and evaluation of an advanced Intrusion detection (IDS) based on a hybrid LSTM-convolution neural network (CNN)-Attention architecture, specifically designed to detect and classify cyberattacks in IIoT environments. The research focuses on two key classification tasks: binary and multi-class classification. The proposed models was rigorously tested using the Edge-IIoTset dataset. To mitigate the class imbalance in the dataset, the synthetic minority over-sampling technique (SMOTE) was employed to generate synthetic samples for the underrepresented classes. This ensured that the model could learn effectively from all classes, thereby improving the overall classification performance. Through systematic experimentation, various deep learning (DL) models were compared, ultimately demonstrating that the LSTM-CNN-Attention model consistently outperformed others across key performance metrics. In binary classification, the model achieved near-perfect accuracy, while in multi-class classification, it maintained a high accuracy level (99.04%), effectively categorizing different attack types with a loss value of 0.0220%.
Paper Structure (8 sections, 5 equations, 5 figures, 3 tables)

This paper contains 8 sections, 5 equations, 5 figures, 3 tables.

Table of Contents

  1. Introduction
  2. Literature review
  3. proposed methodology
  4. Experimentation, results and discussion
  5. Dataset exploration
  6. Performance metrics
  7. Experiments and Results
  8. Conclusion

Figures (5)

  • Figure 1: The proposed LSTM-CNN-Attention model.
  • Figure 2: The Edge-IIoTset dataset attacks types with the number of samples.
  • Figure 3: Accuracy and loss of the LSTM-CNN-Attention: (a) Accuracy of binary and multi-class classification, (b) Loss of binary and multi-class classification.
  • Figure 4: Confusion matrix of the LSTM-CNN-Attention model for multiclass classification.
  • Figure 5: ROC curve of the LSTM-CNN-Attention model for multiclass classification.