SE-Enhanced ViT and BiLSTM-Based Intrusion Detection for Secure IIoT and IoMT Environments
Authors: Afrah Gueriani, Hamza Kheddar, Ahmed Cherif Mazari, Seref Sagiroglu, Onur Ceran
Organizations: LSEA Lab., Faculty of Technology, University of MEDEA, Medea 26000, Algeria · LSEA Lab, Faculty of Science, University of MEDEA, Medea 26000, Algeria · Department of Computer Engineering, Gazi University, Ankara, Turkey · Department of Management Information Systems, Gazi University, Ankara, Turkey
With the rapid growth of interconnected devices in Industrial and Medical Internet of Things (IIoT and MIoT) ecosystems, ensuring timely and accurate detection of cyber threats has become a critical challenge. This study presents an advanced intrusion detection framework based on a hybrid Squeeze-and-Excitation Attention Vision Transformer-Bidirectional Long Short-Term Memory (SE ViT-BiLSTM) architecture. In this design, the traditional multi-head attention mechanism of the Vision Transformer is replaced with Squeeze-and-Excitation attention, and integrated with BiLSTM layers to enhance detection accuracy and computational efficiency. The proposed model was trained and evaluated on two real-world benchmark datasets; EdgeIIoT and CICIoMT2024; both before and after data balancing using the Synthetic Minority Over-sampling Technique (SMOTE) and RandomOverSampler. Experimental results demonstrate that the SE ViT-BiLSTM model outperforms existing approaches across multiple metrics. Before balancing, the model achieved accuracies of 99.11% (FPR: 0.0013%, latency: 0.00032 sec/inst) on EdgeIIoT and 96.10% (FPR: 0.0036%, latency: 0.00053 sec/inst) on CICIoMT2024. After balancing, performance further improved, reaching 99.33% accuracy with 0.00035 sec/inst latency on EdgeIIoT and 98.16% accuracy with 0.00014 sec/inst latency on CICIoMT2024.
Figures & tables
Fig. 1: Architectural workflow for Proposed Model.
Fig. 2: Accuracy and loss of the proposed model. (a): Accuracies before balancing the dataset, (b): Loss before balancing the dataset, (c): Accuracies after balancing the dataset, (d): Loss after balancing the dataset.
B
Dataset
Acc
Loss
Pr
Rc
F1
FPR
Inf time
(%)
(%)
(%)
(%)
(%)
(sec/ins)
No
EdgeIIoT
99.11
0.0247
99.11
99.11
99.11
0.0013
0.00032
CICIoMT2024
96.10
0.1440
96.10
96.10
96.10
0.0223
0.00053
Yes
EdgeIIoT
99.33
0.0158
99.33
99.33
99.33
0.0013
0.00035
CICIoMT2024
98.16
0.0578
98.16
98.16
98.15
0.0036
0.00014
TABLE I: Comprehensive Evaluation Results of the Enhanced SE ViT-BiLSTM Model Using EdgeIIoT and CICIoMT2024 Datasets.
Fig. 3: Confusion matrix of the proposed model. (a): Before balancing the EdgeIIoT dataset, (b): Before balancing the CICIoMT2024 dataset, (c): After balancing the EdgeIIoT dataset, (d): After balancing the CICIoMT2024 dataset.
Fig. 4: ROC curves of the proposed model. (a): Before balancing EdgeIIoT dataset, (b): Before balancing CICIoMT2024 dataset, (c): After balancing EdgeIIoT dataset, (d): After balancing CICIoMT2024 dataset.
Before Data Balancing
EdgeIIoT Dataset
Pr.
Rc
F1
Support
Normal traffic (0)
100%
100%
100%
4 985
DDoS (1)
99%
98%
99%
9 896
Info. gathering (2)
100%
100%
100%
4 333
MITM (3)
100%
100%
100%
255
TABLE II: Classification report for the SE enhanced-ViT-BiLSTM model on EdgeIIoTset and CICIoMT2024 datasets.
TABLE III: Performance of different variants of the proposed models in multiclass classification.
Work
Model
Dataset
Acc
Loss
Pr
Rc
F1
FPR
Inf time
[ 24 ]
Generic CNN
EdgeIIoT
98.98
✗
✗
✗
✗
✗
✗
[ 25 ]
LSTM/DNN
CICIoMT
79
✗
78
79
76
✗
✗
[ 26 ]
CNN-LSTM-ResNet-SA
EdgeIIoMT
33.30
✗
33.31
100
49.97
✗
✗
CICIoT
99.88
✗
99.89
99.99
99.94
✗
✗
[ 23 ]
CNN
EdgeIIoT
96.50
✗
97.48
96.50
96.41
✗
0.00012
CICIoMT
99.67
✗
99.67
99.67
99.66
✗
0.00004
TABLE IV: Performance metrics of the proposed enhanced ViT-BiLSTM model in comparison to state-of-the-art methods for multiclass classification.