A Study on Multi-Class Attack Detection in IoT Networks Using Deep Learning and Attention Mechanisms

Abstract

With the widespread adoption of Internet of Things (IoT) devices and the public release of the Mirai botnet source code, IoT environments are facing increasingly severe security threats. To address these challenges, this study proposes a deep learning–based multi-class IoT attack detection method incorporating an attention mechanism. Experiments were conducted using the CIC-IoT-2023 dataset, which includes 33 types of attack traffic. Considering the temporal characteristics of IoT attacks, this study implements and customizes three temporal deep learning models—Long Short-Term Memory (LSTM), Gated Recurrent Unit (GRU), and Temporal Convolutional Network (TCN). Each model is integrated with a unified attention mechanism to enhance the recognition of critical temporal features. Meanwhile, to mitigate the serious data imbalance commonly found in IoT attack datasets, a multi-level balancing strategy was developed. This strategy combines random undersampling to equalize class distributions, Class-Weighted Focal Loss, and Weighted Random Sampling to ensure balanced batches during training. Experimental results show that the TCN achieved the best overall performance, with all major metrics exceeding 99.5%, while the GRU achieved the highest computational efficiency. Compared with existing studies, the proposed method demonstrates superior performance in application-layer attack detection, maintaining high detection rates for web and reconnaissance attacks, and effectively overcoming current limitations in Layer 7 attack recognition. The contributions of this work are as follows: (1) a systematic performance comparison of LSTM, GRU, and TCN models for multi-class IoT attack detection; and (2) the integration of attention mechanisms with multi-level data balancing strategies, which significantly improve the detection of application-layer and minority-class threats.