An RF-TabPFN-Based Framework for Few-Shot IoT Network Attack Recognition Using Lasso-RFE Feature Selection

With the exponential growth of Internet of Things devices projected to exceed 75 billion by 2025, network security vulnerabilities including eavesdropping, distributed denial-of-service attacks, and firmware hijacking pose significant threats to IoT infrastructure. While existing machine learning approaches show promise in attack detection, they typically suffer from limited interpretability and poor performance on imbalanced datasets with minority attack classes. This study proposes a novel IoT network attack detection framework that integrates Lasso regression and Recursive Feature Elimination with the Random Forest-Tabular Prior-data Fitted Networks model to address these challenges. The methodology employs a three-stage approach: preprocessing and feature engineering using Lasso-Recursive Feature Elimination to reduce dimensionality while maintaining predictive capability, classification using Random Forest-Tabular Prior-data Fitted Networks (a Transformer-based foundation model designed for heterogeneous tabular data and few-shot learning scenarios), and model interpretation through Shapley Additive Explanations analysis to quantify feature contributions. Experimental validation on the Bot-IoT dataset containing 2,668,522 samples with severe class imbalance achieved exceptional performance with 99.89% accuracy and perfect precision and recall for most attack categories. The framework demonstrates superior handling of minority classes compared to traditional approaches, while Shapley analysis identified critical discriminative features such as connection timestamps and destination IP patterns, providing actionable insights for security analysts and representing a significant advancement in IoT security.The source code and data processing scripts are publicly available on GitHub(https://github.com/1558xxx/A-RF-TabPFN-Model-Based-on-Lasso-RFE-for-Feature-Selection.git) to support reproducibility and future extensions.