TL-CRANN: a transfer-learning-based hybrid CNN-RNN model with attention mechanism for cross-domain IoT attack detection

INTRODUCTION: The rapid and pervasive growth of Internet of Things (IoT) devices has significantly expanded the attack surface of current network environments, making them vulnerable to advanced and evolving cyber threats. However, current intrusion detection systems (IDS) usually suffer from weak cross-domain generalization, high false positive rates, and poor performance against novel attacks. METHODS: To overcome these issues, this paper proposes TL-CRANN, a transfer-learning-based hybrid deep learning framework utilizing a convolutional neural network (CNN), bidirectional long short-term memory (Bi-LSTM), and a multi-head self-attention mechanism for cross-domain IoT attack detection. Transfer learning is leveraged to transfer knowledge acquired from source-domain traffic and achieve rapid adaptation to heterogeneous target IoT environments with scarce labeled data. The proposed model is evaluated using three benchmark datasets: CICIDS2017, TON_IoT, and Bot-IoT. RESULTS: Experimental results show that TL-CRANN achieved detection accuracies of 98.37%, 96.21%, and 97.14%, respectively, on the three datasets, and significantly outperformed existing state-of-the-art machine learning and deep learning baselines. DISCUSSION: The results show that transfer learning improves the cross-domain detection performance and training cost. Moreover, the ablation analysis shows that CNN, Bi-LSTM and attention mechanisms-based modules are contribution to effectiveness of proposed framework which also confirms the applicability of TL-CRANN for cross-domain IoT attack detection.