TRACER: Attack-Aware Divide-and-Conquer Transformer for Intrusion Detection in Industrial Internet of Things

Industrial Internet of Things (IIoT) enables smart factories, production, and logistics. However, any vulnerability in the network can lead to severe consequences for both industries and individuals. Being essential cybersecurity tools for IIoT, intrusion detection systems (IDS) play an important role in detecting network attacks. However, IDS can suffer from inaccuracy due to the rare nature of cyberattacks, a.k.a. sample imbalance. In this article, we introduce a transformer-based model termed aTtack-awaRe divide-And-ConquEr tRansformer (<sc xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">Tracer</small>) for both anomaly detection and attack classification, which only needs network traffic data instead of content data. In particular, <sc xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">Tracer</small> incorporates attack-aware learnable queries to enhance category-specific information. A hierarchical divide-and-conquer decoder is also designed tailored to these queries, which is effective in enhancing the accuracy of minority classes. <sc xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">Tracer</small> aims to detect complex, imbalanced traffic attacks without the need for data balancing samplers or separate classifiers. <sc xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">Tracer</small> achieves remarkable 98.8% accuracy in anomaly detection on the UNSW-NB15 dataset, with 0.3% false alarm rate. It also reports multiclass attack accuracy of 86.02%, 96.17%, and 99.48% on the UNSW-NB15, Edge-IIoT, and CICIDS-2017 dataset, respectively, increasing the detection accuracy by about 1%–10%. The results suggest our <sc xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">Tracer</small> model shows potential to be an effective and easy-to-use solution for generic intrusion detection in IIoT.