ImagTIDS: an internet of things intrusion detection framework utilizing GADF imaging encoding and improved Transformer

Abstract

As the Internet of Things (IoT) technology becomes extensively deployed, IoT security issues are increasingly prominent. The traffic patterns of IoT are complex and high-dimensional, which makes it difficult to distinguish the tiny differences between normal and malicious samples. To tackle the above problems, we propose an IoT intrusion detection architecture based on Gramian angular difference fields (GADF) imaging technology and improved Transformer, named ImagTIDS. Firstly, we encode the network traffic data of IoT into images using GADF to preserve more robust temporal and global features, and then we propose a model named ImagTrans for extracting local and global features from network traffic images. ImagTIDS utilizes the self-attention mechanism to dynamically adjust the attention weights and adaptively focus on the important features, effectively suppressing the adverse effects of redundant features. Furthermore, due to the serious class imbalance problem in IoT intrusion detection, we utilize Focal Loss to dynamically scale the model gradient and adaptively reduce the weights of simple samples to focus on hard-to-classify classes. Finally, we validate the effectiveness of the proposed method on the publicly available IoT intrusion detection datasets ToN_IoT and DS2OS, and the experimental results show that the proposed method achieves superior detection performance and higher robustness on class imbalance datasets compared to other remarkable methods.