Efficient IoT Intrusion Detection with an Improved Attention-Based CNN-BiLSTM Architecture

2025-03-25

AI Summary

To address the growing challenge of botnet attack detection in IoT systems, this paper proposes a lightweight and efficient intrusion detection method. Methodologically, it introduces a novel CNN-BiLSTM hybrid architecture enhanced with an adaptive attention mechanism, jointly enabling local traffic pattern recognition and long-term temporal dependency modeling while emphasizing discriminative features. Evaluated on the N-BaIoT dataset, the model achieves 99% detection accuracy with high precision and recall; Matthews Correlation Coefficient and Cohen’s Kappa both approach near-ideal values (≈0.98), significantly outperforming existing lightweight models. Key contributions include: (1) the first attention-enhanced, time-series–convolutional joint model designed specifically for IoT edge deployment; (2) a comprehensive multi-dimensional robustness evaluation framework; and (3) state-of-the-art detection performance under low computational overhead, demonstrating strong practical deployability.

Technology Category

• Machine Learning: Learning on the Edge & Model Compression
• Computer Vision: Adversarial Attacks & Robustness
• Application Domains: Internet of Things, Sensor Networks & Smart Cities

Application Category

• Systems and Infrastructure for Web, Mobile and WoT: Energy management for devices in mobile Web and WoT environments
• Web Mining and Content Analysis: Robustness and generalizability of Web mining methods
• Graph Algorithms and Modeling for the Web: Graph neural networks and deep learning approaches for Web-related graphs

Abstract

The ever-increasing security vulnerabilities in the Internet-of-Things (IoT) systems require improved threat detection approaches. This paper presents a compact and efficient approach to detect botnet attacks by employing an integrated approach that consists of traffic pattern analysis, temporal support learning, and focused feature extraction. The proposed attention-based model benefits from a hybrid CNN-BiLSTM architecture and achieves 99% classification accuracy in detecting botnet attacks utilizing the N-BaIoT dataset, while maintaining high precision and recall across various scenarios. The proposed model's performance is further validated by key parameters, such as Mathews Correlation Coefficient and Cohen's kappa Correlation Coefficient. The close-to-ideal results for these parameters demonstrate the proposed model's ability to detect botnet attacks accurately and efficiently in practical settings and on unseen data. The proposed model proved to be a powerful defense mechanism for IoT networks to face emerging security challenges.

Problem

• Detect botnet attacks in IoT systems
• Improve threat detection with CNN-BiLSTM architecture
• Achieve high accuracy in practical IoT security

Innovation

• Hybrid CNN-BiLSTM architecture for detection
• Attention-based feature extraction and analysis
• High accuracy botnet attack classification