A Multi-Class Intrusion Detection System for DDoS Attacks in IoT Networks Using Deep Learning and Transformers

Area of Science:

• Cybersecurity
• Network Security
• Artificial Intelligence

Background:

• The proliferation of Internet of Things (IoT) devices has led to increased vulnerability to Distributed Denial of Service (DDoS) attacks.
• DDoS attacks in IoT networks disrupt communication, compromise service availability, and cause significant operational and economic losses.

Purpose of the Study:

• To develop and evaluate a Deep Learning (DL)-based Intrusion Detection System (IDS) specifically designed for IoT environments.
• To assess the effectiveness of Convolutional Neural Networks (CNNs), Deep Neural Networks (DNNs), and Transformer models in detecting various classes of DDoS attacks in IoT networks.

Main Methods:

• Implementation of three DL architectures: CNNs, DNNs, and Transformer models for intrusion detection.
• Utilized the CiC IoT 2023 dataset for training and testing the IDS models.
• Employed data preprocessing techniques including log normalization and SMOTE-based oversampling to handle feature distributions and class imbalance.

Main Results:

• Achieved high accuracy in binary classification (DNN: 99.2%, CNN: 99.0%, Transformer: 98.8%) for detecting DDoS attacks.
• Demonstrated near-perfect performance (99.9-100%) in three-class classification (benign, DDoS, non-DDoS).
• Reached strong accuracy in 12-class classification (DNN: 93.0%, CNN: 92.7%, Transformer: 92.5%) encompassing benign traffic and 12 attack types.

Conclusions:

• The proposed DL-based IDS demonstrates high efficacy, precision, recall, and ROC-AUC values for IoT DDoS detection.
• The system outperforms existing state-of-the-art methods in detection accuracy and efficiency, offering a scalable solution.
• Advanced DL models integrated into IDS frameworks provide a robust defense against evolving DDoS threats in IoT networks.