Dynamic Temporal Positional Encodings for Early Intrusion Detection in IoT

TL;DR

This paper presents a Transformer-based intrusion detection system for IoT that uses dynamic temporal positional encodings and data augmentation to improve early threat detection accuracy and efficiency on resource-limited devices.

Contribution

It introduces a novel dynamic temporal positional encoding method for Transformers in IoT intrusion detection and a data augmentation pipeline to enhance model robustness.

Findings

Outperforms existing models in accuracy and early detection on CICIoT2023 dataset.

Achieves low-latency, resource-efficient inference suitable for IoT devices.

Demonstrates effectiveness of dynamic temporal encodings in capturing timing irregularities.

Abstract

The rapid expansion of the Internet of Things (IoT) has introduced significant security challenges, necessitating efficient and adaptive Intrusion Detection Systems (IDS). Traditional IDS models often overlook the temporal characteristics of network traffic, limiting their effectiveness in early threat detection. We propose a Transformer-based Early Intrusion Detection System (EIDS) that incorporates dynamic temporal positional encodings to enhance detection accuracy while maintaining computational efficiency. By leveraging network flow timestamps, our approach captures both sequence structure and timing irregularities indicative of malicious behaviour. Additionally, we introduce a data augmentation pipeline to improve model robustness. Evaluated on the CICIoT2023 dataset, our method outperforms existing models in both accuracy and earliness. We further demonstrate its real-time feasibility on resource-constrained IoT devices, achieving low-latency inference and minimal memory footprint.