Explainable AI for Zero-Day Attack Detection in IoT Networks Using Attention Fusion Model

Explainable AI for Zero-Day Attack Detection in IoT Networks Using Attention Fusion Model | Research Square window.SnipcartSettings = { analytics: { enabled: false } }; (function() { var accessVector = localStorage.getItem('access_vector') || ''; window.dataLayer = window.dataLayer || []; if (accessVector) { window.dataLayer.push({ user: { profile: { profileInfo: { snid: accessVector } } } }); } })(); (function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start':new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0],j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src='https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f);})(window,document,'script','dataLayer','GTM-K279D39R'); Browse Preprints In Review Journals COVID-19 Preprints AJE Video Bytes Research Tools Research Promotion AJE Professional Editing AJE Rubriq About Preprint Platform In Review Editorial Policies Our Team Advisory Board Help Center Sign In Submit a Preprint Cite Share Download PDF Research Article Explainable AI for Zero-Day Attack Detection in IoT Networks Using Attention Fusion Model Deepa Krishnan, Swapnil Singh, Vijayan Sugumaran This is a preprint; it has not been peer reviewed by a journal. https://doi.org/ 10.21203/rs.3.rs-5436116/v1 This work is licensed under a CC BY 4.0 License Status: Published Journal Publication published 28 Jul, 2025 Read the published version in Discover Internet of Things → Version 1 posted 7 You are reading this latest preprint version Abstract The proposed research addresses the challenge of detecting malicious network traffic in IoT environments, focusing on enhancing detection accuracy while ensuring interpretability. The proposed attention fusion classification model utilizes both long-term and short-term attention mechanisms to capture temporal patterns and protocol-specific features, which improves the differentiation between benign and malicious traffic. Empirical results indicate strong performance, with precision-recall scores of 0.9999 for both the DDoS TCP and DDoS UDP classes, and a perfect score of 1.0000 for the Normal class. The model also demonstrates solid performance for the DDoS HTTP (0.9791), Password (0.9418), and SQL Injection (0.9461) classes. Furthermore, it excels at identifying complex behaviors in upload-based attacks and network vulnerabilities, achieving precision-recall scores of 0.9333 for the Uploading class and 0.9963 for the Vulnerability Scanner class. The binary classification accuracy is 99.9966%, and the multiclass accuracy for Zero-day attacks is 71.0926%. The results suggest that the model offers significant potential for improving IoT security. This study introduces the novel use of attention mechanisms for interpretability, enhancing the detection of a broad range of attack types, and contributes to advancing intrusion detection system capabilities. Future research can focus on expanding datasets, refining interpretability techniques, and addressing adversarial vulnerabilities for further model enhancement. Security Attack Explainable AI Detection Zero Day IoT Full Text Additional Declarations No competing interests reported. Cite Share Download PDF Status: Published Journal Publication published 28 Jul, 2025 Read the published version in Discover Internet of Things → Version 1 posted Editorial decision: Revision requested 26 May, 2025 Editor assigned by journal 18 Apr, 2025 Reviews received at journal 10 Apr, 2025 Reviewers agreed at journal 02 Apr, 2025 Reviewers invited by journal 02 Apr, 2025 Submission checks completed at journal 02 Apr, 2025 First submitted to journal 31 Mar, 2025 You are reading this latest preprint version Research Square lets you share your work early, gain feedback from the community, and start making changes to your manuscript prior to peer review in a journal. As a division of Research Square Company, we’re committed to making research communication faster, fairer, and more useful. We do this by developing innovative software and high quality services for the global research community. Our growing team is made up of researchers and industry professionals working together to solve the most critical problems facing scientific publishing. Also discoverable on Platform About Our Team In Review Editorial Policies Advisory Board Help Center Resources Author Services Accessibility API Access RSS feed Manage Cookie Preferences © Research Square 2026 | ISSN 2693-5015 (online) Privacy Policy Terms of Service Do Not Sell My Personal Information {"props":{"pageProps":{"initialData":{"identity":"rs-5436116","acceptedTermsAndConditions":true,"allowDirectSubmit":false,"archivedVersions":[],"articleType":"Research Article","associatedPublications":[],"authors":[{"id":437600763,"identity":"ad8bcaac-db6d-4241-bdb2-2f46bfcd19e1","order_by":0,"name":"Deepa Krishnan","email":"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAZAAAAAyAQMAAABI0h/eAAAABlBMVEX///8AAABVwtN+AAAACXBIWXMAAA7EAAAOxAGVKw4bAAABA0lEQVRIiWNgGAWjYDCCA2AygYGNgQfEsGFgYAaLMBOtJY0ELQwQLYdh4ri18B1vPvbgB0NaPh//2WMPfu44n6fbzp38gaHCOrEBhxbJM8fSDXsYcizbJPLSDXvP3C42O8y7TYLhTDpOLQY3cswkeBgqDNgkeMwkeNtuJ24DamFgbDuMW8v9998k/4C08J8xk/zbdg6kZfMHxn94tNzgYZPmYcgxYGPIMZPmbTsA0rJBgrEBtxbJM2nmxjIGaUCHAbXItiWDHSaRcCzdGJcWvuOHnz18U5FsIN8PdNjbNrvEbefPbv7wocZaFpcWIGADOg9dLAG3cqiWUTAKRsEoGAX4AADLc1hYgM+CXQAAAABJRU5ErkJggg==","orcid":"","institution":"SVKM’s NMIMS University","correspondingAuthor":true,"prefix":"","firstName":"Deepa","middleName":"","lastName":"Krishnan","suffix":""},{"id":437600764,"identity":"26976229-d232-4dbe-a0c8-b0ea0f96a872","order_by":1,"name":"Swapnil Singh","email":"","orcid":"","institution":"Virginia Tech","correspondingAuthor":false,"prefix":"","firstName":"Swapnil","middleName":"","lastName":"Singh","suffix":""},{"id":437600765,"identity":"523d47d4-38d6-4aac-99a4-9a7815f1fdb9","order_by":2,"name":"Vijayan Sugumaran","email":"","orcid":"","institution":"Oakland University","correspondingAuthor":false,"prefix":"","firstName":"Vijayan","middleName":"","lastName":"Sugumaran","suffix":""}],"badges":[],"createdAt":"2024-11-12 04:38:20","currentVersionCode":1,"declarations":"","doi":"10.21203/rs.3.rs-5436116/v1","doiUrl":"https://doi.org/10.21203/rs.3.rs-5436116/v1","draftVersion":[],"editorialEvents":[{"content":"https://doi.org/10.1007/s43926-025-00184-8","type":"published","date":"2025-07-28T16:05:29+00:00"}],"editorialNote":"","failedWorkflow":false,"files":[{"id":88268263,"identity":"25e6f390-0572-4b2a-823c-08c8aa89b3a9","added_by":"auto","created_at":"2025-08-04 16:50:32","extension":"pdf","order_by":1,"title":"","display":"","copyAsset":false,"role":"manuscript-pdf","size":5471794,"visible":true,"origin":"","legend":"","description":"","filename":"ExplainableAIforZeroDayAttackDetectioninIoTNetworksUsingAttentionFusionModelRevised.pdf","url":"https://assets-eu.researchsquare.com/files/rs-5436116/v1_covered_7553be50-7a5b-4304-a9b5-88e4f845ec44.pdf"}],"financialInterests":"No competing interests reported.","formattedTitle":"Explainable AI for Zero-Day Attack Detection in IoT Networks Using Attention Fusion Model","fulltext":[],"fulltextSource":"","fullText":"","funders":[],"hasAdminPriorityOnWorkflow":false,"hasManuscriptDocX":false,"hasOptedInToPreprint":true,"hasPassedJournalQc":"","hasAnyPriority":false,"hideJournal":false,"highlight":"","institution":"","isAcceptedByJournal":true,"isAuthorSuppliedPdf":true,"isDeskRejected":"","isHiddenFromSearch":false,"isInQc":false,"isInWorkflow":false,"isPdf":true,"isPdfUpToDate":true,"isWithdrawnOrRetracted":false,"journal":{"display":true,"email":"[email protected]","identity":"discover-internet-of-things","isNatureJournal":false,"hasQc":true,"allowDirectSubmit":false,"externalIdentity":"diot","sideBox":"Learn more about [Discover Internet of Things](https://www.springer.com/journal/43926)","snPcode":"","submissionUrl":"","title":"Discover Internet of Things","twitterHandle":"","acdcEnabled":true,"dfaEnabled":true,"editorialSystem":"stoa","reportingPortfolio":"Discover Series","inReviewEnabled":true,"inReviewRevisionsEnabled":true},"keywords":"Security Attack, Explainable AI, Detection, Zero Day, IoT","lastPublishedDoi":"10.21203/rs.3.rs-5436116/v1","lastPublishedDoiUrl":"https://doi.org/10.21203/rs.3.rs-5436116/v1","license":{"name":"CC BY 4.0","url":"https://creativecommons.org/licenses/by/4.0/"},"manuscriptAbstract":"\u003cp\u003eThe proposed research addresses the challenge of detecting malicious network traffic in IoT environments, focusing on enhancing detection accuracy while ensuring interpretability. The proposed attention fusion classification model utilizes both long-term and short-term attention mechanisms to capture temporal patterns and protocol-specific features, which improves the differentiation between benign and malicious traffic. Empirical results indicate strong performance, with precision-recall scores of 0.9999 for both the DDoS TCP and DDoS UDP classes, and a perfect score of 1.0000 for the Normal class. The model also demonstrates solid performance for the DDoS HTTP (0.9791), Password (0.9418), and SQL Injection (0.9461) classes. Furthermore, it excels at identifying complex behaviors in upload-based attacks and network vulnerabilities, achieving precision-recall scores of 0.9333 for the Uploading class and 0.9963 for the Vulnerability Scanner class. The binary classification accuracy is 99.9966%, and the multiclass accuracy for Zero-day attacks is 71.0926%. The results suggest that the model offers significant potential for improving IoT security. This study introduces the novel use of attention mechanisms for interpretability, enhancing the detection of a broad range of attack types, and contributes to advancing intrusion detection system capabilities. Future research can focus on expanding datasets, refining interpretability techniques, and addressing adversarial vulnerabilities for further model enhancement.\u003c/p\u003e","manuscriptTitle":"Explainable AI for Zero-Day Attack Detection in IoT Networks Using Attention Fusion Model","msid":"","msnumber":"","nonDraftVersions":[{"code":1,"date":"2025-04-03 04:54:38","doi":"10.21203/rs.3.rs-5436116/v1","editorialEvents":[{"type":"communityComments","content":0},{"type":"decision","content":"Revision requested","date":"2025-05-26T08:30:20+00:00","index":"","fulltext":""},{"type":"editorAssigned","content":"","date":"2025-04-18T12:55:14+00:00","index":"","fulltext":""},{"type":"editorInvitedReview","content":"","date":"2025-04-10T07:17:02+00:00","index":"hide","fulltext":""},{"type":"reviewerAgreed","content":"268940556371720995110392205296525470074","date":"2025-04-02T18:57:45+00:00","index":"hide","fulltext":""},{"type":"reviewersInvited","content":"","date":"2025-04-02T09:53:46+00:00","index":"","fulltext":""},{"type":"checksComplete","content":"","date":"2025-04-02T09:30:20+00:00","index":"","fulltext":""},{"type":"submitted","content":"Discover Internet of Things","date":"2025-03-31T11:58:57+00:00","index":"","fulltext":""}],"status":"published","journal":{"display":true,"email":"[email protected]","identity":"discover-internet-of-things","isNatureJournal":false,"hasQc":true,"allowDirectSubmit":false,"externalIdentity":"diot","sideBox":"Learn more about [Discover Internet of Things](https://www.springer.com/journal/43926)","snPcode":"","submissionUrl":"","title":"Discover Internet of Things","twitterHandle":"","acdcEnabled":true,"dfaEnabled":true,"editorialSystem":"stoa","reportingPortfolio":"Discover Series","inReviewEnabled":true,"inReviewRevisionsEnabled":true}}],"origin":"","ownerIdentity":"a3bebc4c-fcb0-486d-9893-42f6a99e8fd6","owner":[],"postedDate":"April 3rd, 2025","published":true,"recentEditorialEvents":[],"rejectedJournal":[],"revision":"","amendment":"","status":"published-in-journal","subjectAreas":[],"tags":[],"updatedAt":"2025-08-04T16:42:18+00:00","versionOfRecord":{"articleIdentity":"rs-5436116","link":"https://doi.org/10.1007/s43926-025-00184-8","journal":{"identity":"discover-internet-of-things","isVorOnly":false,"title":"Discover Internet of Things"},"publishedOn":"2025-07-28 16:05:29","publishedOnDateReadable":"July 28th, 2025"},"versionCreatedAt":"2025-04-03 04:54:38","video":"","vorDoi":"10.1007/s43926-025-00184-8","vorDoiUrl":"https://doi.org/10.1007/s43926-025-00184-8","workflowStages":[]},"version":"v1","identity":"rs-5436116","journalConfig":"researchsquare"},"__N_SSP":true},"page":"/article/[identity]/[[...version]]","query":{"redirect":"/article/rs-5436116","identity":"rs-5436116","version":["v1"]},"buildId":"8U1c8b4HqxoKbykW_rLl7","isFallback":false,"isExperimentalCompile":false,"dynamicIds":[84888],"gssp":true,"scriptLoader":[]}