Deep Guard: A Novel Transformer-Based Framework for Real-Time Threat Detection in Heterogeneous Cyber Environments

With evolving cyber threats in Internet of Things (IoT) and Industrial IoT (IIoT) networks, challenges with heterogeneous data and dynamic attack patterns cannot be addressed using traditional intrusion detection systems (IDS). We present DeepGuard, a novel deep learning framework for these challenges. DeepGuard enhances detection in space heterogeneous environments by utilizing a transformer architecture augmented with Adaptive Multi-Head Attention (AMHA), implements temporal encoding, and anomaly-aware learning. We propose an algorithm that varies attention mechanisms with the event entropy level, which enables the model to give more attention to underlying patterns while filtering out noise. Specifically, the temporal encoding allows the model to express inter-event dependencies among samples practically, and the anomaly-aware loss function based on the inter-event dependencies makes the detection model sensitive to uncommon attack patterns, leading to its strong generalization capability on unseen threats. We implement the framework on the TON_IoT dataset, where DeepGuard achieves 98.54% accuracy and 98.88% AUC, and outperforms existing models in the other three metrics, including accuracy, precision, and recall. This shows the model's robustness, generalizability, and applicability to work on the interface model alone online and on a large scale. It is more suited for deployment in the modern-day IoT and IIoT environments, considering the complexity of attack patterns and the imbalanced nature of the data. In the future, we plan to optimize this model for deployment on edge devices and to implement federated learning for privacy-preserving distributed training.