Abstract:The Internet of Things (IoT), as the information carrier of the Internet and telecommunications networks, is a new network technology comprising physical entities embedded with electronic components, software and sensors, and characterized by strong complexity and openness. With the massive amount of data, the occurrence of network intrusion is also increasingly frequent, involving industrial control systems, IoT devices, mobile security, cloud services, and telecommunications services. With the diversification and intelligence of cyberattack behaviors, traditional intrusion detection systems (IDSs) face problems—such as insufficient feature extraction and inaccurate model classification—when faced with high-dimensional features and nonlinear massive data. Due to their powerful data representation learning ability, deep learning methods save substantial time in processing high-dimensional and complex intrusion data. On this basis, we propose an intrusion detection model using ResNet, Transformer and BiLSTM (Res-TranBiLSTM) that takes into account both the spatial and temporal features of network traffic. We use the Synthetic Minor Overriding Technique (SMOTE) – Edited Nearest Neighbor (ENN) method to alleviate the degree of data imbalance. In addition, we respectively establish a spatial feature extraction model based on ResNet and a temporal feature extraction model based on Transformer and BiLSTM to extract spatial features and temporal features parallelly. Finally, spatiotemporal features are included to achieve attack detection and classification. Further, simulation experiments are conducted using the public data sets NSL-KDD and CIC-IDS2017. The experiments are implemented using Python programming language and Pytorch framework. The results reveal that the performance of our proposed model is better than that of other models, with accuracy reaching 90.99%, 99.15% and 99.56%, on NSL-KDD dataset, CIC-IDS2017 dataset and MQTTset dataset, respectively. It increased the detection accuracy by about 1%-10% on NSL-KDD dataset and about 0.2%-10% on CIC-IDS2017 dataset, and about 1%-10% on MQTTset dataset. These results demonstrate that this method is effective in constructing and optimizing large-scale IDS in the IoT environment.

Request-Response Network Traffic Packets: Enhancing SQL Injection Attack Detection with a Transformer-Based Model

A novel multi-scale network intrusion detection model with transformer

Deep Neural Network-Based SQL Injection Detection Method

Advancing SQL Injection Detection for High-Speed Data Centers: A Novel Approach Using Cascaded NLP

Deep Learning in Cybersecurity: A Hybrid BERT–LSTM Network for SQL Injection Attack Detection

SQL Injection Attack Detection and Prevention Techniques Using Deep Learning

A Deep Learning-Based Intrusion Detection Model Integrating Convolutional Neural Network and Vision Transformer for Network Traffic Attack in the Internet of Things

A Network Intrusion Detection Method for Information Systems Using Federated Learning and Improved Transformer

Exploring Defense of SQL Injection Attack in Penetration Testing

Fusion of transformer and ML-CNN-BiLSTM for network intrusion detection

An LSTM Based Malicious Traffic Attack Detection in Industrial Internet

INTRUSION DETECTION MODEL BASED ON IMPROVED TRANSFORMER

Res-TranBiLSTM: An Intelligent Approach for Intrusion Detection in the Internet of Things

MDHP-Net: Detecting Injection Attacks on In-vehicle Network using Multi-Dimensional Hawkes Process and Temporal Model

Network intrusion detection based on n-gram frequency and time-aware transformer

DDosTC: A Transformer-Based Network Attack Detection Hybrid Mechanism in SDN

The Detection of Abnormal Behavior by Artificial Intelligence Algorithms Under Network Security

Analysis of the detection of an attack based on SQL injection using an impulse artificial neural network

AI Enhanced Automatic Response System for Resisting Network Threats.

Intrusion detection: A model based on the improved vision transformer

Transformer-based framework for alert aggregation and attack prediction in a multi-stage attack