Toward Intelligent Attack Detection With Causal Transformer in Internet of Things

It is difficult for existing Internet of Things (IoT) intrusion detection systems to simultaneously identify and classify network anomalies, especially when the classification of unknown attacks is required, which brings great risks to the use of IoT devices. This article applies transformers to decouple false associations by causal reasoning to obtain an intelligent interpretable IoT detection system that can classify known attacks and identify unknown attacks. To achieve these goals, a causal transformer-based intelligent detection system for IoT devices is proposed. The system is divided into three main modules. First, training is conducted based on known traffic types with prior knowledge, and then the detection samples containing unknown attack types are classified into known traffic types. Second, the causal feature distribution of known traffic types is learned based on causal attention, and the causal feature distribution differences between normal and abnormal traffic samples are amplified with the minimax strategy to distinguish their types. Then, all traffic samples different from the known types are integrated into unknown types for causal transformer classification until there is only one type. Validation is performed on three broad and representative IoT datasets, and the results show that the causal transformer detection system can not only correctly classify known attacks but also achieve a 100% success rate in identifying cyberattacks on IoT datasets. In addition, more than 99% of unknown attack types can be effectively identified and classified, providing timely and effective guidance for cybersecurity defense.