LDCT-IDS A Lightweight Intrusion Detection System for IoT Networks via Denoising Diffusion Models and Hybrid Convolutional-Transformer Architectur

LDCT-IDS A Lightweight Intrusion Detection System for IoT Networks via Denoising Diffusion Models and Hybrid Convolutional-Transformer Architectur | Research Square window.SnipcartSettings = { analytics: { enabled: false } }; (function() { var accessVector = localStorage.getItem('access_vector') || ''; window.dataLayer = window.dataLayer || []; if (accessVector) { window.dataLayer.push({ user: { profile: { profileInfo: { snid: accessVector } } } }); } })(); (function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start':new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0],j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src='https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f);})(window,document,'script','dataLayer','GTM-K279D39R'); Browse Preprints In Review Journals COVID-19 Preprints AJE Video Bytes Research Tools Research Promotion AJE Professional Editing AJE Rubriq About Preprint Platform In Review Editorial Policies Our Team Advisory Board Help Center Sign In Submit a Preprint Cite Share Download PDF Research Article LDCT-IDS A Lightweight Intrusion Detection System for IoT Networks via Denoising Diffusion Models and Hybrid Convolutional-Transformer Architectur Zhendong Wang, ChengYi Ye, Chen Tu, Daojing He, Sammy Chan This is a preprint; it has not been peer reviewed by a journal. https://doi.org/ 10.21203/rs.3.rs-8183839/v1 This work is licensed under a CC BY 4.0 License Status: Posted Version 1 posted You are reading this latest preprint version Abstract Malicious traffic is one of the most central hazards in IoT security, and accurately detecting malicious traffic is crucial for maintaining the proper functionality of IoT devices. With recent advancements in artificial intelligence, deep learning models have become powerful tools for classifying malicious traffic, but deep learning models with high floating-point operations for parameters are difficult to deploy because IoT devices are usually resource constrained. In addition, the unbalanced nature of network data poses a great challenge to traffic classification. Addressing the problem from both data generation and intrusion detection aspects, this study presents a novel method based on a deep learning framework that combines a denoising diffusion probabilistic model and a Transformer-enhanced convolutional neural network. For the data generation task, our approach leverages classifier-free guidance within the Denoising Diffusion Probabilistic Model (DDPM) framework. We then systematically evaluate this model against conventional data generation techniques. Our approach achieves superior accuracy and demonstrates a more effective capture of the categorical feature distribution. In the intrusion detection phase, we analyzed the proposed method combining Convolutional Neural Networks with Transformer on two distinct datasets, Edge-IIoTset and CSE-CIC-IDS2018, which achieved 99.92% and 99.28% detection accuracy, respectively. The proposed framework demonstrates its superiority over existing methods, as validated by the experimental results. Intrusion Detection Data Generation DDPM CNN Transformer IOT Full Text Additional Declarations No competing interests reported. Cite Share Download PDF Status: Posted Version 1 posted You are reading this latest preprint version Research Square lets you share your work early, gain feedback from the community, and start making changes to your manuscript prior to peer review in a journal. As a division of Research Square Company, we’re committed to making research communication faster, fairer, and more useful. We do this by developing innovative software and high quality services for the global research community. Our growing team is made up of researchers and industry professionals working together to solve the most critical problems facing scientific publishing. Also discoverable on Platform About Our Team In Review Editorial Policies Advisory Board Help Center Resources Author Services Accessibility API Access RSS feed Manage Cookie Preferences © Research Square 2026 | ISSN 2693-5015 (online) Privacy Policy Terms of Service Do Not Sell My Personal Information {"props":{"pageProps":{"initialData":{"identity":"rs-8183839","acceptedTermsAndConditions":true,"allowDirectSubmit":true,"archivedVersions":[],"articleType":"Research Article","associatedPublications":[],"authors":[{"id":559225724,"identity":"744db579-83fb-4f1e-ab42-356699063334","order_by":0,"name":"Zhendong Wang","email":"","orcid":"","institution":"JiangXi University of Science and Technology","correspondingAuthor":false,"prefix":"","firstName":"Zhendong","middleName":"","lastName":"Wang","suffix":""},{"id":559225732,"identity":"0eda57c2-3dea-46e3-b799-3faf2bc831a5","order_by":1,"name":"ChengYi Ye","email":"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAZAAAAAyAQMAAABI0h/eAAAABlBMVEX///8AAABVwtN+AAAACXBIWXMAAA7EAAAOxAGVKw4bAAAA1ElEQVRIie3RoQvCQBTH8QcHs5yu3pjMv0A4OFCGosF/5ETQsiw2DwZbEqth/4Ww/ORAyzRbLaYVsRo0atrZBO/bP/AePwCb7QdzWgfUj0WfDNcxmpEGo2OkxbTG2V6akYCBwHqiXQ4RNzzMVxK9RPtdKG7nEgZBW1WR5g6Rn2YijFfbMIOJ6GAVASlRznsTwGPuU8BxbkA4okOWCqOrIWGS71QyIhwjx5DQQmoopsTb7EWYcYNfWmmq7/Ca0nXjy7lcDIJK8hGjhtO8k2+FzWaz/UVPmeNFQiYlxK0AAAAASUVORK5CYII=","orcid":"","institution":"JiangXi University of Science and Technology","correspondingAuthor":true,"prefix":"","firstName":"ChengYi","middleName":"","lastName":"Ye","suffix":""},{"id":559225733,"identity":"f24719ec-9dd8-4a52-b550-185a3eebf79d","order_by":2,"name":"Chen Tu","email":"","orcid":"","institution":"South China Normal University","correspondingAuthor":false,"prefix":"","firstName":"Chen","middleName":"","lastName":"Tu","suffix":""},{"id":559225734,"identity":"20856c5c-454c-400e-b4c8-27053ad68f45","order_by":3,"name":"Daojing He","email":"","orcid":"","institution":"Harbin Institute of Technology","correspondingAuthor":false,"prefix":"","firstName":"Daojing","middleName":"","lastName":"He","suffix":""},{"id":559225739,"identity":"c6912752-6fef-4c76-9417-30ad3a8bde3f","order_by":4,"name":"Sammy Chan","email":"","orcid":"","institution":"City University of Hong Kong","correspondingAuthor":false,"prefix":"","firstName":"Sammy","middleName":"","lastName":"Chan","suffix":""}],"badges":[],"createdAt":"2025-11-23 07:08:08","currentVersionCode":1,"declarations":"","doi":"10.21203/rs.3.rs-8183839/v1","doiUrl":"https://doi.org/10.21203/rs.3.rs-8183839/v1","draftVersion":[],"editorialEvents":[],"editorialNote":"","failedWorkflow":false,"files":[{"id":98365624,"identity":"b19e23ca-b768-436f-b15c-2f36d04ed147","added_by":"auto","created_at":"2025-12-17 03:58:06","extension":"json","order_by":0,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":6713,"visible":true,"origin":"","legend":"","description":"","filename":"92b8acc47e1e419fa8e010707ee8ddf5.json","url":"https://assets-eu.researchsquare.com/files/rs-8183839/v1/f3e3d3c1849529a6707262ab.json"},{"id":98439736,"identity":"d5f5ceb0-d77c-408b-8065-af68f3137fd1","added_by":"auto","created_at":"2025-12-17 17:02:51","extension":"pdf","order_by":1,"title":"","display":"","copyAsset":false,"role":"manuscript-pdf","size":789717,"visible":true,"origin":"","legend":"","description":"","filename":"IDCTIDS.pdf","url":"https://assets-eu.researchsquare.com/files/rs-8183839/v1_covered_e4388dfb-6fe4-47c8-bb30-e4b632f59a44.pdf"}],"financialInterests":"No competing interests reported.","formattedTitle":"LDCT-IDS A Lightweight Intrusion Detection System for IoT Networks via Denoising Diffusion Models and Hybrid Convolutional-Transformer Architectur","fulltext":[],"fulltextSource":"","fullText":"","funders":[],"hasAdminPriorityOnWorkflow":false,"hasManuscriptDocX":false,"hasOptedInToPreprint":true,"hasPassedJournalQc":"","hasAnyPriority":false,"hideJournal":true,"highlight":"","institution":"","isAcceptedByJournal":false,"isAuthorSuppliedPdf":true,"isDeskRejected":"","isHiddenFromSearch":false,"isInQc":false,"isInWorkflow":false,"isPdf":true,"isPdfUpToDate":true,"isWithdrawnOrRetracted":false,"journal":{"display":true,"email":"[email protected]","identity":"researchsquare","isNatureJournal":false,"hasQc":true,"allowDirectSubmit":true,"externalIdentity":"","sideBox":"","snPcode":"","submissionUrl":"/submission","title":"Research Square","twitterHandle":"researchsquare","acdcEnabled":true,"dfaEnabled":false,"editorialSystem":"","reportingPortfolio":"","inReviewEnabled":false,"inReviewRevisionsEnabled":true},"keywords":"Intrusion Detection, Data Generation, DDPM, CNN, Transformer, IOT","lastPublishedDoi":"10.21203/rs.3.rs-8183839/v1","lastPublishedDoiUrl":"https://doi.org/10.21203/rs.3.rs-8183839/v1","license":{"name":"CC BY 4.0","url":"https://creativecommons.org/licenses/by/4.0/"},"manuscriptAbstract":"Malicious traffic is one of the most central hazards in IoT security, and accurately detecting malicious traffic is crucial for maintaining the proper functionality of IoT devices. With recent advancements in artificial intelligence, deep learning models have become powerful tools for classifying malicious traffic, but deep learning models with high floating-point operations for parameters are difficult to deploy because IoT devices are usually resource constrained. In addition, the unbalanced nature of network data poses a great challenge to traffic classification. Addressing the problem from both data generation and intrusion detection aspects, this study presents a novel method based on a deep learning framework that combines a denoising diffusion probabilistic model and a Transformer-enhanced convolutional neural network. For the data generation task, our approach leverages classifier-free guidance within the Denoising Diffusion Probabilistic Model (DDPM) framework. We then systematically evaluate this model against conventional data generation techniques. Our approach achieves superior accuracy and demonstrates a more effective capture of the categorical feature distribution. In the intrusion detection phase, we analyzed the proposed method combining Convolutional Neural Networks with Transformer on two distinct datasets, Edge-IIoTset and CSE-CIC-IDS2018, which achieved 99.92% and 99.28% detection accuracy, respectively. The proposed framework demonstrates its superiority over existing methods, as validated by the experimental results.","manuscriptTitle":"LDCT-IDS A Lightweight Intrusion Detection System for IoT Networks via Denoising Diffusion Models and Hybrid Convolutional-Transformer Architectur","msid":"","msnumber":"","nonDraftVersions":[{"code":1,"date":"2025-12-17 03:58:01","doi":"10.21203/rs.3.rs-8183839/v1","editorialEvents":[{"type":"communityComments","content":0}],"status":"published","journal":{"display":true,"email":"[email protected]","identity":"researchsquare","isNatureJournal":false,"hasQc":true,"allowDirectSubmit":true,"externalIdentity":"","sideBox":"","snPcode":"","submissionUrl":"/submission","title":"Research Square","twitterHandle":"researchsquare","acdcEnabled":true,"dfaEnabled":false,"editorialSystem":"","reportingPortfolio":"","inReviewEnabled":false,"inReviewRevisionsEnabled":true}}],"origin":"","ownerIdentity":"a118c0f8-a4fd-4973-aa21-c5c052348a3a","owner":[],"postedDate":"December 17th, 2025","published":true,"recentEditorialEvents":[],"rejectedJournal":[],"revision":"","amendment":"","status":"posted","subjectAreas":[],"tags":[],"updatedAt":"2025-12-17T03:58:01+00:00","versionOfRecord":[],"versionCreatedAt":"2025-12-17 03:58:01","video":"","vorDoi":"","vorDoiUrl":"","workflowStages":[]},"version":"v1","identity":"rs-8183839","journalConfig":"researchsquare"},"__N_SSP":true},"page":"/article/[identity]/[[...version]]","query":{"redirect":"/article/rs-8183839","identity":"rs-8183839","version":["v1"]},"buildId":"8U1c8b4HqxoKbykW_rLl7","isFallback":false,"isExperimentalCompile":false,"dynamicIds":[84888],"gssp":true,"scriptLoader":[]}