A robust cross-domain IDS using BiGRU-LSTM-attention for medical and industrial IoT security

The increased Internet of Medical Things (IoMT) and the Industrial Internet of Things (IIoT) interconnectivity has introduced complex cybersecurity challenges, exposing sensitive data, patient safety, and industrial operations to advanced cyber threats. To mitigate these risks, this paper introduces a novel transformer-based intrusion detection system (IDS), termed BiGAT-ID—a hybrid model that combines bidirectional gated recurrent units (BiGRU), long short-term memory (LSTM) networks, and multi-head attention (MHA). The proposed architecture is designed to effectively capture bidirectional temporal dependencies, model sequential patterns, and enhance contextual feature representation. Extensive experiments on two benchmark datasets; CICIoMT2024 (medical IoT) and EdgeIIoTset (industrial IoT); demonstrate the model’s cross-domain robustness, achieving detection accuracies of 99.13% and 99.34%, respectively. Additionally, the model exhibits exceptional runtime efficiency, with inference times as low as 0.0002 seconds per instance in IoMT and 0.0001 seconds in IIoT scenarios. Coupled with a low false positive rate, BiGAT-ID proves to be a reliable and efficient IDS for deployment in real-world heterogeneous IoT environments.