Attention-Enhanced Hybrid Architecture for Efficient Intrusion Detection in Industrial IoT

Abstract

The rapid convergence of the Internet of Things (IoT) and the Industrial Internet of Things (IIoT) has increased exposure to advanced and coordinated cyber threats. Existing deep learning-based intrusion detection system (IDS) designs often suffer from high computational cost, limited interpretability, and poor handling of temporal dependencies in IIoT traffic. To address these challenges, we propose CKAN–BiLSTM, a hybrid architecture that integrates 1D convolutional Kolmogorov–Arnold networks (CKAN) for compact and interpretable spatial feature extraction with a bidirectional long short-term memory (BiLSTM) module for temporal modeling and a dot-product attention mechanism for dynamic feature prioritization. The design preserves the parameter efficiency of Kolmogorov–Arnold networks (KANs) while capturing the long-range dependencies essential for IIoT traffic analysis. The proposed framework is evaluated on the publicly available TON-IoT dataset, which includes telemetry and network traffic from diverse IoT and IIoT devices, spanning seven device types and multiple attack families. The model is extensively validated under a 10-fold cross-validation setup using both conventional and advanced performance metrics. Device-wise analysis shows consistently low off-diagonal errors despite class imbalance, and benchmark comparisons situate our results within a broad range of IoT/IIoT IDS studies, indicating competitive performance without relying on parameter-heavy architectures. These results establish CKAN–BiLSTM as an effective and lightweight IDS for real-time IIoT intrusion detection, paving the way for future extensions to streaming adaptation and privacy-preserving federated learning.