Explainable Dual Branch Attention Network for Industrial IoT Intrusion Detection

Abstract The rapid expansion of the Industrial Internet of Things (IIoT) has broadened the cyberattack surface across critical infrastructure. Conventional intrusion detection systems often process isolated flow metrics without capturing local cross-feature correlations or sequential feature dynamics, while operating as opaque black boxes. To address these challenges, we propose CP-XNet, a lightweight dual-branch deep learning framework tailored for edge-deployable cyber-physical intrusion detection. Under this architectural framing, spatial denotes localised cross-attribute correlations along the engineered feature axis, while temporal represents sequential dependencies across ordered intra-flow functional feature segments rather than multi-packet or inter-flow time series. CP-XNet couples a feature-axis 1D-Convolutional Neural Network (CNN) for localised cross-feature extraction with a Bidirectional Gated Recurrent Unit (BiGRU) for structured feature-segment sequence modelling, dynamically fused via a compact two-token Multi-Head Self-Attention (MHSA) mechanism. Dual-tier visual explainability (SHAP and LIME) provides protocol-level transparent decision support. Evaluated across three contemporary cyber-physical benchmark testbeds under binary detection and multi-class threat attribution, CP-XNet achieves: 99.49% binary and 94.39% multi-class accuracy on ToN-IoT Industrial Telemetry; 99.97% binary and 99.84% multi-class accuracy on InSDN Software-Defined Networking; and 95.75% binary and 93.65% multi-class accuracy on CIC-IIoT-2025 Multi-Device traffic. Across all benchmarks, batch-amortised forward-pass latency on GPU hardware remains strictly bounded between 0.0077 and 0.0128 ms per sample (0.0710 ms on CPU at batch size B=256, alongside streaming single-sample latencies of 0.0820 ms GPU and 0.4100 ms CPU), translating to an estimated nominal power-envelope energy proxy of 0.077-0.128 mJ on GPU (0.710 mJ on CPU) under a nominal 10-W edge envelope. A prospective IEC 61850 digital substation deployment architecture illustrates passive edge integration boundaries.