An Intrusion Detection Model Based on a Residual Memory Convolutional Neural Network with Attention Mechanism

Abstract

Abstract As the utilization of IoT devices becomes more widespread, the variety of attacks targeting these devices is also increasing. Traditional intrusion detection systems in IoT environments often struggle to effectively recognize the diverse types of attacks. Therefore, this study proposes a Residual Memory Convolutional Neural Network (RMCNN) model incorporating an attention mechanism, aimed at improving the accuracy and efficiency of multi-class attack detection in IoT environments. The model begins by extracting spatial features from traffic data through Convolutional Neural Network (CNN) layers, and then captures dynamic changes in time series data using Gated Recurrent Unit (GRU). Subsequently, a multi-head attention mechanism is employed to reinforce focus on critical information. Finally, the outputs from the GRU are combined with those from the multi-head attention mechanism via residual connections, enhancing the model’s learning capabilities and improving the recognition accuracy of various attack types. Verified through experiments on the CICIOT2023 dataset, the model achieved an F1 score of 97.29%, indicating significant improvements in the detection performance of multi-class attacks and confirming its applicability and effectiveness in the field of IoT security.