A hybrid denoising autoencoder and Query-Key attention-based framework for intrusion detection in software defined industrial networks
摘要
Software-Defined Networking (SDN) brings flexibility and centralized control to Industrial IoT (IIoT) environments, but also increases exposure to advanced cyber threats. To strengthen security in such settings, this paper introduces “DAE-QKATTN-IDS,” a hybrid intrusion detection framework that combines a Denoising Autoencoder for robust feature extraction, an LSTM-based latent dependency model for learning temporal correlations, and a Query–Key Additive Attention mechanism for selective contextual feature refinement. To alleviate class imbalance in intrusion datasets, the framework employs SMOTE and is evaluated on both original and augmented data. Comprehensive experiments under uniform conditions show that the proposed framework achieves the highest detection accuracy of 99.67% and an F1-score of 99.16%, outperforming the best existing baselines by 1.4% in accuracy and up to 4.4% in F1-score, while maintaining low false alarm rates and strong resilience under noisy and imbalanced conditions. Although the proposed IDS demonstrates strong empirical performance, its real-world effectiveness, consistent with any advanced security solution, will rely on ongoing adaptation to evolving industrial traffic behaviors and operational constraints to ensure sustained reliability.