Attention-Enhanced Hybrid Architecture for Efficient Intrusion Detection in Industrial IoT
Ahmed Elwhishi, Awad A. Younis, Adnan Akhunzada · IEEE Open Journal of the Communications Society · 2026
The rapid convergence of the Internet of Things (IoT) and the Industrial Internet of Things (IIoT) has increased exposure to advanced and coordinated cyber threats. Existing deep learning-based intrusion detection system (IDS) designs often suffer from high computational cost, limited interpretability, and poor handling of temporal dependencies in IIoT traffic. To address these challenges, we propose CKAN–BiLSTM, a hybrid architecture that integrates 1D convolutional Kolmogorov–Arnold networks (CKAN) for compact and interpretable spatial feature extraction with a bidirectional long short-term memory (BiLSTM) module for temporal modeling and a dot-product attention mechanism for dynamic feature prioritization. The design preserves the parameter efficiency of Kolmogorov–Arnold networks (KANs) while capturing the long-range dependencies essential for IIoT traffic analysis. The proposed framework is evaluated on the publicly available TON-IoT dataset, which includes telemetry and network traffic from diverse IoT and IIoT devices, spanning seven device types and multiple attack families. The model is extensively validated under a 10-fold cross-validation setup using both conventional and advanced performance metrics. Device-wise analysis shows consistently low off-diagonal errors despite class imbalance, and benchmark comparisons situate our results within a broad range of IoT/IIoT IDS studies, indicating competitive performance without relying on parameter-heavy architectures. These results establish CKAN–BiLSTM as an effective and lightweight IDS for real-time IIoT intrusion detection, paving the way for future extensions to streaming adaptation and privacy-preserving federated learning.