HYBRID GAT-AUTOENCODER-BILSTM-ATTENTION ARCHITECTURE FOR MULTI CLASS CYBERATTACK DETECTION IN HETEROGENEOUS IOT NETWORKS

Abstract

A novel hybrid deep learning architecture combining a Graph Attention Network (GAT), an Autoencoder (AE), a Bidirectional Long Short-Term Memory network (BiLSTM) and a Multi Head Self Attention (MHSA) is proposed into a single intrusion detection framework. The suggested traffic model integrates graph-based traffic representation, feature extraction based on unsupervised learning, modelling of temporal dependencies and adaptive feature weighting to encompass structural and behavioral characteristics of network traffic in diverse IoT settings. The scientific novelty of the work is the ability to integrate all four components in one end-to-end trainable pipeline, which is not supported by any of the existing Transformer, CNN-LSTM or single component GNN approaches and to fine-grained classify attacks over the CICIoT2023 using 26 different classes. The model's accuracy was 96.52% and the weighted F1 score was 0.9646. A lightweight variant featuring INT8 dynamic quantization was also explored for edge deployment, which was found to be 25 times smaller with only a 0.41 percentage point drop in accuracy.