An explainable multimodal temporal deep learning framework for intrusion detection (EMT-IDNet) in IoT environments

The high rate of Internet of Things (IoT) ecosystem development presents a significant security problem because of the heterogeneity of devices, dynamic network behaviour, and the lack of built-in security features. Traditional intrusion detection systems (IDS) cannot detect multi-stage attacks to IoT systems, and this issue is mainly due to their use of single-modality information and the poor temporal modeling properties of these applications. This paper seeks to overcome these shortcomings by offering the explainable multimodal temporal deep learning framework of intrusion detection (EMT-IDNet). The proposed model combines different data sources network traffic, logs on host operating system and IoT telemetry using modality-specific encoders and cross-modal attention-based fusion block. Temporal attention module gets ultimate attack sequences and detects key time moments related to malicious actions. Additionally, an attention-based hierarchical multi-layered perceptron (TA-MLP) classifier can be used to identify binary and multi-class intrusion with high efficiency and interpretability as demonstrated by visualization of attention weights. Empirical testing on TON-IoT data reveals that EMT-IDNet has a binary classification with 99.98% accuracy, 99.99% precision, 99.97% recall and 99.98% F1-score, and its AUC value is 0.9999. The framework offers significant temporal as well as modality-level explanations, which increase trust and practical utility to applications in the real world IoT security.