A Robust Cross-Domain IDS using BiGRU-LSTM-Attention for Medical and Industrial IoT Security

TL;DR

This paper presents BiGAT-ID, a hybrid transformer-based intrusion detection system combining BiGRU, LSTM, and multi-head attention, demonstrating high accuracy and efficiency across medical and industrial IoT datasets.

Contribution

Introduces a novel cross-domain IDS model that effectively captures temporal dependencies and contextual features using a hybrid BiGRU-LSTM-Attention architecture.

Findings

Achieves over 99% detection accuracy on benchmark datasets.

Exhibits extremely low inference times, enabling real-time detection.

Maintains low false positive rates in heterogeneous IoT environments.

Abstract

The increased Internet of Medical Things IoMT and the Industrial Internet of Things IIoT interconnectivity has introduced complex cybersecurity challenges, exposing sensitive data, patient safety, and industrial operations to advanced cyber threats. To mitigate these risks, this paper introduces a novel transformer-based intrusion detection system IDS, termed BiGAT-ID a hybrid model that combines bidirectional gated recurrent units BiGRU, long short-term memory LSTM networks, and multi-head attention MHA. The proposed architecture is designed to effectively capture bidirectional temporal dependencies, model sequential patterns, and enhance contextual feature representation. Extensive experiments on two benchmark datasets, CICIoMT2024 medical IoT and EdgeIIoTset industrial IoT demonstrate the model's cross-domain robustness, achieving detection accuracies of 99.13 percent and 99.34 percent, respectively. Additionally, the model exhibits exceptional runtime efficiency, with inference times as low as 0.0002 seconds per instance in IoMT and 0.0001 seconds in IIoT scenarios. Coupled with a low false positive rate, BiGAT-ID proves to be a reliable and efficient IDS for deployment in real-world heterogeneous IoT environments