Multi-task Temporal Deep Learning Model for Real Time Intrusion Detection System

Abstract

The rapid expansion of Internet of Things (IoT) ecosystems has enabled large-scale interconnected smart environments while simultaneously exposing IoT devices to increasingly sophisticated cyber threats. To address these challenges, machine learning and deep learning–based intrusion detection systems (IDS) have been widely adopted; however, many existing approaches suffer from limited generalization, insufficient temporal modeling, and poor performance under extreme class imbalance. In this study, we investigate a multi-task stacked Long Short-Term Memory (LSTM) architecture for IoT intrusion detection, where binary anomaly detection and multi-class attack classification are jointly learned within a unified temporal framework. The proposed model examines different inter-path knowledge transfer mechanisms, including additive, gated, and attention-based aggregation, to enhance discriminative attack representation learning. A topology-constrained shuffling strategy is further introduced to preserve intra-flow temporal dependencies while reducing reliance on fixed traffic ordering. Experimental results on the Edge-IIoTset dataset show that all models achieve high binary detection performance (F1-score above 97%), while attention-based aggregation consistently outperforms static fusion strategies for multi-class classification, yielding superior macro F1-score and AUC-PR under severe class imbalance. These findings emphasize the importance of context-aware information sharing and temporal structure preservation for robust and adaptive IoT intrusion detection systems.