TS-IDF: A Two-Stage Intrusion Detection Framework for Complex Maritime IoT

In the rapidly evolving field of Maritime Internet of Things (MIoT), the interconnection of ships, ports, and offshore platforms has accelerated the digitalization of Maritime Transportation Systems (MTS). However, this growing connectivity has led to heightened cybersecurity vulnerabilities, especially Zero-day Attacks, which pose a significant challenge to the safe and efficient operation of MIoT systems. Current Intrusion Detection Systems (IDS) primarily rely on passive defense mechanisms that require manual threat analysis, resulting in low detection accuracy and inefficiency, particularly in handling the large-scale and complex data generated by MIoT networks. To address these issues, this paper introduces a Two-Stage Intrusion Detection Framework (TS-IDF) specifically designed for identifying Zero-day Attacks in the MIoT context. The first stage employs a Random Forest algorithm to perform rapid anomaly detection by processing vast amounts of heterogeneous data, filtering potential threats. The second stage uses a deep learning model that integrates 1D Convolutional Neural Networks (1D-CNN) and External Attention (EA) mechanisms to deeply analyze complex attack patterns. The 1D-CNN captures sequential features, while the EA mechanism enhances key feature extraction. The detection performance is further improved through the use of residual networks and fully connected layers. The proposed TS-IDF framework substantially strengthens cybersecurity defenses in MIoT, with experimental results demonstrating an overall accuracy of 99.17% and a Zero-day Attack recall rate of 91.28% on the CIC-IDS-2017 dataset, significantly surpassing existing state-of-the-art methods.