Ifedayo Michael Atalabi

10.23246/AAIRJ.2025.02.01.02

Transformer ddos detection IoT

As cyber threats in IoT networks become increasingly sophisticated, identifying Man-in-the-Middle (MitM) and Distributed Denial of Service (DDoS) attacks with high precision is critical. This study pioneers the application of a Transformer-based model, fortified with self-attention mechanisms, to serve as a state-of-the-art intrusion detection system. This research specifically excels in feature selection and sequence classification within IoT network traffic data. Data is transformed into sequential representations through preprocessing, facilitating the model's ability to capture temporal relationships and contextual understanding. The Transformer model, tailored for sequence classification, auto-learns essential features from the processed data. Multi-headed self-attention allows the model to focus on varied aspects of network data, enhancing detection capabilities. The model is fine-tuned using a cross-entropy loss function on a labeled dataset comprising MitM and DDoS instances, as well as benign traffic. During inference, the model assigns anomaly scores to sequences, flagging those with high scores as likely attacks. Trained and evaluated on the recently released Edge-IIoTset dataset, the model achieved an accuracy rate of 98.50%. In comparisons, it outperformed traditional classifiers like Support Vector Machines, Long Short-Term Memory, and Deep Recurrent Neural Networks. The model attained an F1 score of 99.39%, evidencing its efficacy in balancing false positives and negatives—an essential metric in network security. This study highlights the potential of deploying Transformer-based models in intrusion detection systems. The system's performance underscores a new paradigm in proactive cybersecurity measures, opening avenues for adaptive network defense mechanisms. Future research could optimize the model's architecture and expand its applications across cybersecurity domains.