Intrusion Detection in Industrial Internet of Things Using Lite Long Short-Term Memory and Convolutional Neural Network with Attention Mechanism

The rapid expansion of the Industrial Internet of Things (IIoT) has heightened the risk of cyber threats targeting critical infrastructure, making effective Intrusion Detection Systems (IDS) essential. However, the existing Long Short-Term Memory and Convolutional Neural Network with Attention mechanism (LSTM-CNN-Attention) suffer from high computational complexity, which makes it unsuitable for real-time deployment on resource-constrained IIoT edge devices. Hence, this study proposes LiteLSTM-CNN-Attention (LLCA) to enable real-time ID on IIoT edge devices. Initially, IIoT network data are collected from the Edge-IIoTset dataset, which obtains IIoT traffic data with real-world conditions. Then, the data are preprocessed using label encoding, min-max normalization, and the synthetic minority oversampling technique (SMOTE) to convert heterogeneous data into a suitable format. Subsequently, depth-wise separable conv1D layers were employed to extract the spatial patterns as features. Next, the temporal patterns are captured using pruned LSTM layers for lightweight sequence learning, and a lightweight attention mechanism is integrated to emphasize the relevant temporal features efficiently. Finally, the fully connected dense layer detects class labels by indicating either normal traffic or a specific attack type. The proposed LLCA achieved better results in terms of accuracy (0.9962) than the existing CNN-Recurrent Neural Network and Support Vector Machine Framework (CRSF) models.