Attention-Enhanced Hybrid Deep Learning for Intrusion Detection in IoT Networks

Abstract

The escalating deployment of Internet of Things (IoT) devices across critical infrastructure demands intrusion detection systems (IDS) capable of reliably discriminating hierarchically structured cyber threats such as denial-of-service, man-in-the-middle, Mirai, and scan attacks. This study proposes a hybrid CNN-GRU-attention architecture in which parallel convolutional and recurrent branches are fused through a cross-modal attention mechanism computing joint scores from spatial and temporal features via a shared scoring function, enabling adaptive per-sample prioritisation of the more discriminative branch. ADASYN and ProWRAS oversampling strategies are compared within a leakage-free pipeline across binary, category and sub-category classification on IoTID20, and validated independently on TON-IoT against six deep learning baselines. On IoTID20, test accuracies reach 1.0000, 0.9995 and 0.8228/0.8225 (ADASYN/ProWRAS). McNemar's tests show no significant difference between samplers, although per-class analysis reveals a precision–recall trade-off at the sub-category tier. On TON-IoT, the model achieves 0.9788 accuracy and F1-score, exceeding six baselines on most metrics, trailing only in balanced accuracy due to one underrepresented class. Attention-weight analysis shows concentration decreasing with granularity, with ProWRAS inducing a more distributed pattern that explains this trade-off. An ablation study confirms attention and oversampling chiefly improve precision (0.8019–0.9005) over accuracy, though residual Mirai confusion reflects a feature-space limitation.