An Efficient CNN + Sparse Transformer-Based Intrusion Detection Method for IoT

The burgeoning proliferation of Internet of Things (IoT) devices escalates concerns over network security. Intrusion detection, crucial for IoT security, frequently employs deep learning techniques for feature extraction and machine learning algorithms for model construction. However, imbalances in datasets and inadequate focus on temporal intrusion patterns compromise detection accuracy and efficiency. In this paper, we propose an intrusion detection model based on CNN with Sparse Transformer (CST), in which local features are extracted by CNN convolutional pooling operation; then temporal features are extracted by Sparse Transformer, which uses sparse self-attention to replace the traditional dense attention of Transformer, and suppresses the attention weights with lower values by setting 0, preserves attention weights of higher magnitude, reduces the data involved in the operation and intensifies the focus of self-attention; in order to solve the problem of imbalance of attack kinds in the data set, the EQL v2 loss function is used to increase the weights of the minority classes and balance the learning attention to the minority classes. Experiments show that the CST model has high intrusion detection accuracy, has good stability and generalization ability, and shows good performance on the four datasets of Edge_IIoT, UNSW-NB 15, CICIDS-2017 and CICIDS-2018, with detection accuracies of 99.24%, 92.41%, 99.55%, and 99.65%, respectively, achieving higher values in detection accuracy, recall rate, and F1 score compared to traditional methods.