DUAL-HYBRID TRANSFORMER–CONVOLUTIONAL NEURAL NETWORK WITH EXPLAINABLE ARTIFICIAL INTELLIGENCE FOR ZERO-DAY INTRUSION DETECTION IN HETEROGENEOUS INTERNET OF THINGS NETWORKS

Abstract

Rapid growth of the heterogeneous Internet of Things (IoT) network has expanded the attack surface that malwares have to face , while traditional single-architecture deep learning Intrusion Detection System (IDS) are unable to defend themselves against zero-day attacks. Current convolutional or recurrent detectors focus on either the local structure of a packet or on long-term temporal dependence, but not on both, and with the blackbox nature of such detectors, security analysts are not ready to trust. In this paper, we propose DB-TC-XAI, a 2-in-1 detector to merge 1D spatial features obtained by the 1D convolutional branch with 1D sequential features from traffic by the Transformer-encoder branch using the 2D bidirectional cross-attention module. A combined Shapley Additive explanation’s (SHAP) and attentionrollout explanation layer is used to provide decision transparency , while Synthetic Minority Oversampling Technique (SMOTE)-Tomek resampling is used to reduce class imbalance. The model is tested over 3 heterogeneous benchmarks (TON_IoT, CICIoT202 , and UNSW-NB15) using closed set testing and leave-one-attack-out. The experimental results show that the proposed model achieves competitive detection accuracy with a low false-positive rate, better generalization to unknown attack classes than representative baselines, and produces consistent, human-interpretable detection outcomes.