IJCNC 08

Dual-Hybrid Transformer–Convolutional Neural Network with Explainable Artificial Intelligence for Zero-Day Intrusion Detection in Heterogeneous Internet of Things Networks

Rabins Porwal1 , Anil Kumar Yadav2 , Shilpi Dubey3 and Ashish Seth4

1Professor, Department of Computer Application, School of Engineering & Technology (UIET), Chhatrapati Shahu Ji Maharaj University (CSJMU), Kanpur, Uttar Pradesh, India

²Controller of Examination, Mahatma Jyotiba Phule Rohilkhand University, Bareilly, Uttar Pradesh, India

3Assistant Professor, Department of Computer Application, School of Engineering & Technology (UIET), Chhatrapati Shahu Ji Maharaj University (CSJMU), Kanpur, Uttar Pradesh, India
4Professor, Inha University in Tashkent, Uzbekistan

ABSTRACT
Rapid growth of the heterogeneous Internet of Things (IoT) network has expanded the attack surface that malwares have to face , while traditional single-architecture deep learning Intrusion Detection System (IDS) are unable to defend themselves against zero-day attacks. Current convolutional or recurrent detectors focus on either the local structure of a packet or on long-term temporal dependence, but not on both, and with the blackbox nature of such detectors, security analysts are not ready to trust. In this paper, we propose DB-TC-XAI, a 2-in-1 detector to merge 1D spatial features obtained by the 1D convolutional branch with 1D sequential features from traffic by the Transformer-encoder branch using the 2D bidirectional cross-attention module. A combined Shapley Additive explanation’s (SHAP) and attentionrollout explanation layer is used to provide decision transparency , while Synthetic Minority Oversampling Technique (SMOTE)-Tomek resampling is used to reduce class imbalance. The model is tested over 3 heterogeneous benchmarks (TON_IoT, CICIoT202 , and UNSW-NB15) using closed set testing and leave-one-attack-out. The experimental results show that the proposed model achieves competitive detection accuracy with a low false-positive rate, better generalization to unknown attack classes than representative baselines, and produces consistent, human-interpretable detection outcomes.

KEYWORDS
Convolutional Neural Network (CNN), Explainable Artificial Intelligence (XAI), Internet of Things (IoT), Intrusion Detection, Transformer, Zero-Day Attacks

1. INTRODUCTION
The Internet of Things (IoT) has grown from the margins to a computing fabric presently connecting billions of sensors, actuators, vehicles, medical devices, and industrial controllers. These advances have led to a corresponding increase in the number and sophistication of cyber attacks on resource-poor and heterogeneous IoT deployments [1] [2]. Many IoT endpoints can’t support heavyweight cryptographically-intensive security, and they are often shipped with default or easily guessed credentials, making them appealing targets for attackers aiming to build botnets, steal sensitive telemetry or disrupt critical services [3], [4]. Network intrusion detection systems (IDS) thus still play an irreplaceable role as the second line of defense by constantly monitoring the network traffic to alert any suspicious activity before it becomes an attack and results in a complete compromise [5].

For the last 10 years, we have seen a paradigm change in the IDS domain from signature matching to data-driven anomaly detection using machine learning through advances and recent years using deep learning [6],[7]. Convolutional neural networks (CNNs) have demonstrated effectiveness in capturing the discriminative local patterns from the packet headers and flow statistics [8, 9] while recurrent architectures like long short-term memory (LSTM) and gated recurrent unit (GRU) networks have shown good results in capturing the temporal evolution of traffic sessions [10, 11]. The convolutional-recurrent hybrid candidate architectures, such as CNN-GRU and BiLSTM-CNN detectors, have achieved a precision of more than 99% on various commonly-used testbeds [12] [13] [14]. Yet, three remaining challenges hinder the practical use of deep-learning-based IDS for a heterogeneous IoT environment.

First, it is inherently an incomplete feature extraction : a single paradigm. A pure convolutional model is biased towards spatially local payload/flow patterns and cannot effectively model longrange dependencies across the flow, while a pure recurrent or attention-based model has the ability to capture flow sequential context, but lacks the ability to represent the fine-grained spatial structure in individual packets [15] [16] Partial solutions to this tension are cascaded hybrids but they bring the opposite kind of compression, since the temporal model is required to compress features compressed already by the convolutional front-end, thereby potentially discarding complementary information.

Second, the generalization capability against zero-day attacks remains inadequate. Most reported evaluations operate under closed-set assumptions, in which every attack family encountered at test time was also represented during training. As novel attack variants grow in number and diversity, the macro-averaged F1 of conventional detectors drops markedly, with recent benchmarks showing declines from the high nineties to the low seventies on held-out attack families [17], [18], [19]. This brittleness is especially problematic for IoT deployments, where new attack primitives constantly emerge, yet labelled data for the latest threats is effectively unavailable. ‘

Finally, deep detectors are opaque, leading to a lack of analysts’ trust. A model that provides only a binary or categorical verdict (without a supporting explanation) provides little actionable information in a SOC (security operations centre), and further hinders triage and incident response, and regulation compliance [20] [21]. Explainable artificial intelligence (XAI) methods such as Shapley Additive exPlanations (SHAP) and attention attribution have begun to appear in the intrusion detection literature [22] [23] [24]; however, very few studies combine multiple explanation signals into a unified, coherent narrative, and how to effectively integrate them with dual-paradigm architectures is still an open question.

The Dual-Branch Transformer-Convolutional Neural Network (CNN) model for Explainable Artificial Intelligence (XAI), referred to as DB-TC-XAI, is therefore proposed in this paper. Rather than cascading paradigms sequentially, the architecture runs two branches in parallel: a one-dimensional Convolutional Neural Network (1D-CNN) branch to encode spatially local patterns from packet-header and flow-statistic vectors, and a Transformer-encoder branch to capture long-range sequential dependencies through multi-head self-attention. A bidirectional cross-attention fusion module enables each branch to selectively attend to the other’s

representations, and a shared classification head produces the final decision. To counteract class imbalance, which is prevalent in intrusion datasets, Synthetic Minority Over-sampling Technique (SMOTE)-Tomek resampling is restricted to the training partition [25] and [26], while interpretability is delivered by a dual XAI layer that couples SHAP feature attributions with Transformer attention rollout. The model is evaluated not only under the conventional closed-set protocol, but also through a leave-one-attack-out (LOAO) protocol that explicitly simulates zeroday conditions [18] [27].

The principal contributions of this work are summarized as follows:

1. A dual-branch architecture that processes spatial and sequential representations in parallel and fuses them through a bidirectional cross-attention module, avoiding the information bottleneck inherent in cascaded CNN-recurrent hybrids.
2. A combined explainability layer that aligns SHAP-based global and local feature attributions with Transformer attention rollout, allowing the two signals to corroborate one another and produce analyst-facing explanations.
3. An explicit zero-day evaluation protocol based on leave-one-attack-out training, which quantifies generalization to unseen attack families rather than relying solely on closed-set accuracy.
4. A comprehensive empirical study across three heterogeneous benchmarks (TON_IoT, CICIoT2023 , and UNSW-NB15), including ablation studies that isolate the contribution of each branch, the fusion module, and the resampling strategy.

The rest of this paper is structured as follows. Section 2 surveys the literature on deep-learningbased intrusion detection, hybrid and Transformer architectures, zero-day attack detection, and explainable security. Section 3 describes the complete DB-TC-XAI methodology, covering the preprocessing pipeline, the two parallel branches, the cross-attention fusion module, the explainability layer, and the training procedure. Section 4 presents the experimental setup, dataset descriptions, evaluation metrics, the zero-day protocol, experimental results, ablation studies, and explainability analyses. Section 5 concludes the paper and identifies directions for future research.

2. RELATED WORK

Recent literature on deep-learning detection models for IoT intrusion detection, hybrid and Transformer-based modelling architectures, zero-day and unseen attack detection, and explainable ID is provided as follows. The discussion is structured so as to provide emphasis both on the advances realized and on the problems that provide the impetus for the current effort.

2.1. Deep Learning for IoT Intrusion Detection

In the early days, Deep-learning IDS took the place of hand-crafted feature engineering by representation learning. Convolutional models converted tabular flow records to pseudo-images or 1-D sequences, and used convolutional filters to enforce the learning discriminative structure of their local neighbours. Compared to 2D CNN models, the authors of [9] showed that a lightweight 1D CNN can effectively achieve competitive accuracy on the commonly used benchmarks; a result that was also observed by Deshmukh and Ravulakollu [8] when using a compact CNN for IoT cybersecurity scenarios. Weights were also introduced for salient feature maps to further enhance discrimination, as in the attention-based CNN of Momand et al. [28]. Meanwhile, recurrent detectors using an LSTM and GRU did leverage the sequence nature of network sessions; Banaamah and Ahmad [11] and Wang et al. [29] have reported good results but left out the fact that recurrent arcs come with additional computation cost for constrained devices.

A common feature of these studies is that convolutional models have a strong ability to learn local patterns and have found it hard to model long-range dependency, whilst recurrent models have demonstrated strong modelling of temporal context but poor spatial detail[52]. This complementary asymmetry is the main observation that has led to the design of a dual-branch detector with parallel operations, instead of a single-paradigm detector.

2.2. Hybrid and Transformer-Based Detectors

Many studies have explored hybrid architectures to capture both spatial and temporal characteristics of network traffic. CNN-LSTM, CNN-GRU, and CNN-BiLSTM models have demonstrated strong performance on IoT intrusion detection benchmarks [12–14, 30, 31]. However, most cascaded architectures process a single feature stream sequentially, potentially limiting the preservation of complementary information. More recently, Transformer-based IDS models have been proposed to capture long-range dependencies in network traffic [32–35]. Hybrid Transformer-CNN approaches with resampling and feature-fusion mechanisms have also been investigated [16, 36]. Furthermore, attention-based dual-branch frameworks have introduced cross-attention and explainability components to enhance feature fusion and interpretability [37, 38]. Despite these advances, most existing studies rely on representation concatenation and closed-set evaluation. In contrast, the proposed DB-TC-XAI model employs bidirectional cross-attention between CNN and Transformer branches, integrates SHAP with attention rollout for explainability, and evaluates generalization using a leave-one-attack-out protocol across three heterogeneous benchmarks. The summary of representative deep-learning IDS studies is presented in Table 1.

Table1 . Representative deep-learning IDS studies (2021–2025).

2.3. Zero-Day and Unseen-Attack Detection

Zero-day detection departs from the closed-set paradigm by requiring a model to correctly identify attack families that were absent from the training distribution. Soltani et al. [18] introduced a flexible open-set detector (DOC++) and assessed it against held-out attack classes on CICIDS2017. Semi-supervised learning for the detection of zero-day intrusions was demonstrated by Mbona and Eloff [39], while Hairab et al. [40] and [41] demonstrated improvement in the robustness to novel attacks in IoT networks using regularized onedimensional CNNs. More recently, Korba et al. [42] proposed an open set federated framework for zero day detection for IoVs and Dai et al. [19] used an auto encoder along with classical
classifiers for the detection of unseen samples. Akhtar et al. [27] have used the leave-one-attackout approach with wavelet-augmented autoencoders. Table 2 provides a comparison of typical 0- day methods and their assessment systems. One observation that has been made is that detectors with the highest closed set accuracy often do not have the highest accuracy when it comes to unseen attacks; for this, reason it is important to state both.

Table 2 . Representative zero-day / unseen-attack detection studies.

2.4. Explainable Intrusion Detection

Reasonable Explanation has become a first-class security analytics requirement. Moustafa et al. [20] conducted a survey of explainable IDS for IoT and represented the lack of trust that is attributed to the black-box detectors. In the literature, post-hoc attribution methods prevail, including Le et al. [23] ensemble attribution with SHAP, Younisse et al. [24] XAI application to convolutional detectors and Sharma et al. [43] means to create deep-learning based XAI pipeline for IoT IDS. To address this, Abou El Houda et al. [44] designed an explainable deep framework specifically designed with analyst trust in mind, and Arreche et al. [45] compared multiple blackbox explanation frameworks for network IDS. Attention-based interpretability is an intrinsic signal based upon the self-attention weights of the Transformer encoders. Mixing salient explanation signals together for validating them is actually a newly arising practice; for instance, Nugraha et al. [46] use SHAP and LIME attribution together as a reliable check on one another. Furthermore, only a limited number of detectors combine a post-hoc attribution method (e.g., SHAP) with an attention signal derived from a game (e.g., attention rollout), or, an external game-theoretic attribution method and the model’s own internal attention flow: the present model makes this pairing, and states how well the two methods agree. Table 3 shows representative papers on the explainable IDS and the methods used.

Table 3 . Representative explainable IDS studies and techniques.

In summary, literature shows (i) that both the convolutional and attention-based modelling approaches have complementary strengths, (ii) that there is a proven reduction in performance when testing closed-set detectors under ‘zero day’ conditions and (iii) that there is an ongoing but underdeveloped research on explainability. We propose a dual-branch model that tackles them all concurrently via parallel branches, cross-attention fusion, an explicit leave-one-attack-out evaluation, and a dual SHAP-plus-attention explanation layer.

3. PROPOSED METHODOLOGY

This section describes the design of DB-TC-XAI: a dual-branch Transformer-CNN intrusion detector augmented with an explainability layer. The presentation covers problem formulation, the data preprocessing and resampling pipeline, the two parallel feature-extraction branches, the cross-attention fusion module and classification head, the explainability layer, and the end-to-end training procedure. The overall system architecture is depicted in Figure 1.

3.1. Problem Formulation

A labelled traffic corpus is represented by D = {(xi, yi)} : for i=1…N, where each xi is a network flow feature vector of size F and yi is its class label from a set of C classes (C ≥ 1), including the benign class and one or more families of attacks. In the closed-set scenario, it is an objective of learning a mapping f_θ that minimizes the expected classification risk over the data distribution. In a formal sense, the model parameters θ are learned by minimising the empirical risk.

where L denotes the categorical cross-entropy loss and the second term is an L2 weight-decay regularizer controlled by λ. Under the zero-day scenario, the class set is partitioned into known classes observed during training and unknown classes that appear exclusively at test time; the detector must flag malicious traffic belonging to families whose distributions were never encountered during optimization. This partitioning is formalized in the leave-one-attack-out (LOAO) protocol described in Section 4.

3.2. Data Preprocessing and Class Balancing

Before raw flow records can be fed into the network, they need to be cleansed and normalized. The pre-processing pipeline consists of the following operations, applied to the data in turn. Nota-number markers are assigned to infinite or missing values generated by export_from_flow files and the not-a-number values are imputed by the per-feature median over the training partition. Low-cardinality categorical attributes are one-hot encoded while high-cardinality ones undergo label encoding to avoid feature-space explosion; the resulting attributes are incorporated directly. All continuous features are subsequently mapped to the interval [0, 1] via min-max normalization,

where x_j is the j-th feature, minimum does not involve information leakage with validation in the training partition alone, and ε is a small constant that protects against division by zero. The bounded non-negative inputs, which interact nicely with the distance comparisons of the resampling stage and the bounded ranges of activation of the network, are important factors resulting in the preference for min-max scaling over standardization.

Intrusion datasets are typically highly imbalanced, with minority attack classes vastly underrepresented relative to benign or dominant attack traffic. To prevent the classifier from collapsing toward the majority class, SMOTE-Tomek resampling is applied exclusively within the training partition. Specifically, the Synthetic Minority Over-sampling Technique (SMOTE) constructs a synthetic minority sample x_new by interpolating between an existing minority instance x_i and a randomly selected minority neighbor x_nn drawn from its k nearest neighbors,

It is then followed by Tomek-link cleaning to remove adjacent nodes that are very close to each other and have different classes to sharpen the decision boundary and eliminate synthesized nodes that fall into the region of the majority class. Resampling would only be on the training fold, and the validation and test data sets would maintain their original class distribution, with metrics reported in light of this natural class distribution. The entire preprocessing and balancing process is summarized in Algorithm 1.

Algorithm1. Preprocessing and SMOTE-Tomek balancing.

Input : raw corpus D_raw, feature set F, target ratio r
Output: balanced train set D_tr’, clean val/test sets D_val, D_te
1: D_raw <- replace(+/-Inf, NaN); median-impute on train statistics
2: encode categorical features (one-hot / label)
3: fit MinMax scaler on D_tr; apply to D_tr, D_val, D_te // Eq. (2)
4: (D_tr, D_val, D_te) <- stratified split (70/15/15)
5: for each minority class c in D_tr do
6: while ratio(c) < r do
7: pick x_i in c; find k nearest minority neighbours
8: x_nn <- random neighbour; delta ~ U(0,1)
9: x_new <- x_i + delta*(x_nn – x_i) // Eq. (3)
10: add x_new to D_tr
11: end while
12: end for
13: remove Tomek links from D_tr -> D_tr’
14: return D_tr’, D_val, D_te

3.3. Overall Architecture

Each preprocessed flow vector is fed simultaneously into two parallel branches, as illustrated in Figure 1. Within the convolutional branch, the vector is treated as a one-dimensional signal and a stack of convolutional filters extracts spatially local structures, capturing correlations among neighboring positions in the flow feature vector. The Transformer branch processes the same vector by tokenizing it and applying multi-head self-attention to model long-range dependencies across all feature positions, irrespective of distance. Outputs from both branches are projected to a common embedding dimension and combined through a bidirectional cross-attention fusion module (Figure 2), whose output is then forwarded to a fully connected classification head. The explainability layer operates post-training, deriving SHAP attributions from the classification head and attention-rollout maps from the Transformer branch.

 

Figure1 . Overall architecture of the proposed DB-TC-XAI model.

3.4. Convolutional Branch

The reshaped feature vector in this case is of dimension F × 1, which goes through the first three convolutional blocks in the convolutional branch. Every block consists of a 1-dimensional convolution, batch normalization, a rectifier, and max pooling. The l-th convolutional layer: When the network input is a feature map h and the filter bank W and bias b, the l-th convolutional layer computes:

The BN represents BN and the * is the one dimensional convolution operator. The three blocks have 64, 128, and 256 filters, respectively, and they all have the same-padding with a width of 3, which means that the receptive field increases with depth, and the local structure is preserved. Rectified Linear activation is defined by taking the element-wise activation to be

A max-pooling layer with a stride two follows each convolutional block, progressively halving the temporal resolution and building increasingly abstract representations. Rather than collapsing all feature maps into a single global vector, the final feature maps are projected channel-wise to a common width d via a 1×1 convolution, yielding a sequence of TC token embeddings zC of shape (TC, d), where TC equals the temporal length remaining after pooling. Retaining this sequence structure is essential for the cross-attention fusion described in Section 3.6. The branch topology is consistent with established 1D-CNN-based intrusion detection practice [9, 24] and is deliberately lightweight so that it can be deployed at or near the network edge.

3.5. Transformer-Encoder Branch

The Transformer branch represents the feature vector as a series of tokens and utilizes multi-head self-attention to study relations among locations of features without caring for distance between them. Each feature position is first embedded into a d-dimensional space and then a trainable Positional Encoding is added to preserve the order information,

where E is the learnable embedding matrix and P is the positional-encoding matrix. The core computational primitive of the encoder is scaled dot-product attention. Given query, key, and value matrices Q, K, and V obtained as linear projections of the input, attention is computed as

with d_k the dimension of the key vectors and the scaling factor a stabilizer of gradients. Multihead attention consists of h parallel attention functions that work independently on h distinct subspaces and then concatenate the results,

Each encoder layer consists of a multi-head self-attention sublayer and a position-wise feedforward network, both surrounded by residual connections and layer normalization,

where the feed-forward network performs two linear transformations (matrix multiplications) interspersed with a rectified-linear activation. The branch is composed of four stack of the aforementioned encoder layers with eight attention heads, embedding dimension d of 128, and feed-forward dimension of 512, where the dropout of attention and feed-forward sublayers are0.1. The output of the per-position encoder is not pooled to a single vector – instead, each position is represented by a token zT of shape (TT, d) so that each position is available to the fusion module. These hyperparameters are based on the Transformer-IDS ones as reported by Wu et al. [32] and Long et al. [47].

3.6. Cross-Attention Fusion

Instead of just concatenating the two branch embeddings, seen as independent and no interaction, the proposed model (Figure 2) combines them using a bidirectional cross-attention module. The module allows the convolutional branch to pay attention to the information in the Transformer branch and the other way around, enabling selective emphasis on information within each branch. Obtain the two branches’ token sequences, zC of shape (TC, d) and zT of shape (TT, d), where TC, TT > 1. The convolution-to-Transformer attention allows each convolutional token to look at all Transformer tokens and each Transformer token to look at all convolutional tokens,

As the softmax in the equation (12) is not applied over the entire sequence of TT keys, it does not end up being an identity and enables a real, context-dependent mixing of the two branches versus fixed linear mixing. The symmetric attention Transformer-to-convolution A{T←C} (of shape (TT, d)) is calculated in the same fashion as the attention Convolution-to-Transformer A{C←T}: Transformer output (of shape (TT, dTR)) is used to project into d keys or values, and the resulting keys or values represent the output of the projection network. The two attended sequences are concatenated on the token axis, projected and added to the inputs via a residual connection, layer-normalized and mean-pooled across the token axis to obtain the fused embedding zF which is passed to the classification head,

The concatenation is indicated with a semicolon, while the symbols WF, ZF and z_F are learnable projections, z_F being the mean-pooled vector of size d. Thus, the spatial evidence is “justified” by the textual contexts in the fused embedding and vice versa. While, in the data flow, pooling to the same vector happens only after the cross-attention fusion, for the sake of visualization, the per-branch projection and the final pooling are depicted within the branch blocks of Figure 1. The main advantage of this sequence level cross-attention architecture lies on its primary difference with either cascaded hybrids [30], [12] or concatenation-based fusions [16], [36].

Figure2 . Bidirectional cross-attention fusion module.

3.7. Classification Head and Objective

The fused embedding z_F is passed through a fully connected head with a hidden dense layer, dropout and a final softmax that yields a probability distribution over the C classes,

Training minimizes the categorical cross-entropy between the predicted class distribution and the one-hot ground-truth label,

augmented by the L2 weight-decay term of Equation (1). For the binary detection setting the softmax reduces to a sigmoid and the loss to binary cross-entropy.

3.8. Explainability Layer

Two complementary mechanisms jointly provide interpretability, and they are expected to produce mutually consistent explanations. The first is SHAP, which attributes each feature’s contribution to a model’s output by computing Shapley values grounded in cooperative game theory. The Shapley value for feature j is obtained by averaging its marginal contribution across all possible feature subsets S ⊆ N of the entire feature set, as the marginal contribution of feature j to these subsets.

where v(S) is the model output (in the case of the feature subset S). A deep-network approximation (DeepSHAP) can efficiently estimate them from a set of background samples derived from the training set. SHAP provides not just feature importance (which is understood as an average of the absolute attributions over many samples), but per-instance explanations to back up individual predictions.

The second mechanism is attention rollout, which is the sum of the Transformer branch’s selfattention weights across layers to measure the flow of information from the input features to the pooled features. Averaging over heads and combining with an identity (which accounts for the residual connections), the rollout is the matrix product

where A_l is the head-averaged attention of layer l, and I is the identity. The branch aggregates tokens via mean pooling (without any classification-token) and the rollout is averaged across the rows of tokens from R to obtain a per-feature, cumulative-attention vector. Due to their distinctiveness, SHAP and attention rollout have been introduced as post hoc game-theoretic and intrinsic attention explanations, respectively, meaning that the agreement on the top features confirms the faithfulness of the explanation. The end-to-end training and explanation procedure is given in Algorithm 2.

Algorithm2. DB-TC-XAI training and explanation.

Input: balanced train D_tr’, val D_val, epochs T, batch size B
Output: trained model f_theta, explanations (SHAP, rollout)
1: initialize CNN branch, Transformer branch, fusion, head
2: for epoch = 1 to T do
3: for each mini-batch (X, Y) of size B in D_tr’ do
4: z_C <- CNNBranch(X) // Eq. (4)-(5)
5: z_T <- TransformerBranch(X) // Eq. (6)-(11)
6: z_F <- CrossAttentionFusion(z_C, z_T) // Eq. (12)-(13)
7: Y_hat <- Head(z_F) // Eq. (14)
8: L <- CrossEntropy(Y_hat, Y) + lambda*||theta||^2
9: theta <- AdamUpdate(theta, grad L)
10: end for
11: evaluate macro-F1 on D_val; early-stop if no gain
12: end for
13: phi <- DeepSHAP(f_theta, background, samples) // Eq. (16)
14: R <- AttentionRollout(Transformer layers) // Eq. (17)
15: return f_theta, (phi, R)

3.9. Implementation and Training Configuration

The model is trained with the Adam optimizer at an initial learning rate of 1×10⁻³, reduced on plateau to 1×10⁻⁴, with a batch size of 256, dropout rates ranging from 0.1 to 0.3, and a ceiling of60 epochs with early stopping triggered after 10 consecutive epochs without improvement in validation macro-F1. The convolutional branch employs three blocks with 64, 128, and 256 filters and a kernel width of 3, while the Transformer uses an embedding dimension of 128, 8 attention heads, and 4 encoder layers. The key hyperparameters are consolidated in Table 4. All experiments use stratified 70/15/15 train, validation, and test splits, with SMOTE-Tomek resampling restricted to the training partition. The full pipeline is implemented in PyTorch together with scikit-learn and imbalanced-learn; one-hot encoding of categorical attributes yields input dimensions of 52, 46, and 196 for TON_IoT, CICIoT2023, and UNSW-NB15, respectively. Every baseline reported in Section 4 is retrained under the same preprocessing, resampling, partitioning, and optimization budget, using five fixed random seeds to ensure fair comparison.

Table 4 . Principal hyperparameters of the DB-TC-XAI model.

4. EXPERIMENTS AND RESULTS

We present the experimental environment, the datasets, evaluation measures and evaluation zero day protocol and then the closed-set detection results, evaluation baselines and to previous work, ablation studies, evaluation results for generalization in zero day and explainability analysis. All the numerical values in this section are determined from the experimental configuration mentioned above.

4.1. Datasets

Three public benchmarks are used which are all heterogeneous, meaning the overall evaluation is diverse, covering different IoT and conventional network conditions. TON_IoT [48] is a multitier heterogeneous testbed comprising edge, fog and cloud layers consisting of a set of nine attack scenarios and benign traffic. CICIoT2023 [49] is a real-time IoT dataset collected from over a hundred physical IoT devices and consists of seven different attack families that produced denialof-service, reconnaissance, spoofing, web based attack, brute force attack, Mirai style botnet attack among other attacks. The UNSW-NB15 [50] benchmark is a popular network intrusion benchmark with nine attack classes and rich 49-feature representation from using multiple flow analysers. These three datasets can be combined and run through the model with both devicelevel IoT telemetry as well as traditional network flows. In table 5, their key features are summarized.

Table5 . Summary of the three evaluation datasets.

4.2. Evaluation Metrics

The quality of detection is measured using accuracy, precision, recall and macro-averaged F1- score as well as false positive rate and area under the receiver operating characteristic curve. The metrics are: True positives TP, true negatives TN, false positives FP and false negatives FN are defined following the standard classification evaluation framework [51].

In the context of intrusion detection, where datasets are often severely imbalanced, inflated overall accuracy can mask poor performance on minority attack classes. Macro-averaging is therefore employed: a metric is computed independently for each class and then averaged uniformly across all classes, ensuring that rare attack families receive equal weight. The Matthews correlation coefficient is additionally reported as a single balanced summary statistic.

4.3. Experimental Environment

All models are implemented in PyTorch and trained on a single GPU workstation. Baseline methods are re-implemented and retrained under the identical preprocessing, resampling, and partitioning pipeline described in Section 3, ensuring that any observed performance differences stem solely from architectural choices rather than data handling. Each experiment is executed across five distinct random seeds; results are reported as the mean and standard deviation computed over these five runs. Statistical significance of improvements over the best-performing baseline is evaluated using a paired t-test on the matched seed runs at a significance level of 0.05, with the outcome noted alongside each comparison.

4.4. Closed-Set Detection Results

The three datasets’ closed-set performance of the proposed model is presented in the multi-class scenario as indicated in Table 6. The model’s accuracy and macro F1 is consistently high while the false-positive rate is kept low. Performance is the highest on CICIoT2023, which is the large volume dataset where the representation learning can be stable; and the lowest performance is obtained using UNSW-NB15, where the attacks are classified into fine-grained and partially overlapping classes, which in the literature is known to be more challenging to perform [15] [31]. For TON_IoT this confusion matrix is displayed in Fig. 3 and, as seen, the majority of flows in each class is classified as correctly, with a residual hardly noticeable confusion concentrated among semantically close classes of attacks.

Table6 . Closed-set multi-class performance of DB-TC-XAI (mean ± standard deviation over five seeds)..

Binary detection ROC curves for all three datasets are presented in Figure 4. The curves rise steeply toward the upper-left corner, and the corresponding area under the curve (AUC) values all exceed 0.996, indicating that the detector reliably discriminates benign from malicious traffic across a wide range of operating thresholds. Training dynamics are visualized in Figure 5, which shows the two branches converging smoothly: training and validation accuracy increase in tandem, while both training and validation loss decline steadily without the divergence that would signal overfitting

Figure3 . Confusion matrix of DB-TC-XAI on the TON_IoT multi-class task.

Figure4 . ROC curves for binary detection on the three datasets.

Figure5 . Training and validation accuracy (a) and loss (b) over epochs

4.5. Comparison with Baselines and Prior Work

Table 7 benchmarks DB-TC-XAI against four representative baselines reproduced within the identical pipeline: a standalone 1D-CNN, a standalone Transformer encoder, a cascaded CNNGRU hybrid, and a concatenation-based Transformer-CNN. The proposed cross-attention model surpasses all baselines on macro-F1 across every dataset, with the largest gains over the singleparadigm detectors and a smaller but consistent advantage over the concatenation-based hybrid. The improvements are statistically significant on all three datasets for the five matched seed runs (paired t-test, p < 0.05), confirming that it is the bidirectional inter-branch interaction enabled by cross-attention—rather than simply combining both branches—that drives the performance gain. As shown in Table 8, the model also compares favorably with recently published detectors in the literature; despite differences in experimental pipelines, dataset splits, and reported metrics across studies, DB-TC-XAI matches or slightly exceeds the closest prior hybrid detectors [16, 36] while additionally providing a zero-day generalization evaluation and dual explainability, capabilities that those works do not offer.

The gain of DB-TC-XAI over the concatenation baseline is statistically significant on all three datasets (paired t-test across the five seeds, p < 0.05).

4.6. Ablation Study

In an ablation study, the effect of each component can be measured and for the TON_IoT results are presented in Table 9. A symmetric removal of the Transformer branch and a symmetric removal of the convolutional branch led to degradation of macro-F1, respectively, both suggesting that both representations are essential. This shows that inter-branch interaction, not just both the branches, is what helps performance, and indeed when the cross attention fusion is removed and just concatenation is performed, there is a measurable decrease. As an example, when SMOTE-Tomek is disabled and the base distribution is used, macro-F1 is much more adversely affected due to rare classes being underrepresented, although there is not a significant difference in overall accuracy. Removal of the explain ability layer does not impact the detection as it is a post-hoc analysis and added for completeness.

4.7. Zero-Day Generalization

A leave one attack out (LOAO) protocol is used to evaluate the ability to generalize to unseen attacks. Each attack family is stripped from their respective training and validation partitions, and only presented when test time occurs; that is, the model is expected to respond correctly when presented with a family of which it doesn’t see the distribution throughout the optimization process. At inference time, detection is performed assuming that we can only identify a flow as malicious, as opposed to identifying a benign family, using the following criteria on the class posterior scores produced by the softmax head: If the maximum posterior scored across all classes (excluding the held-out family) is below a confidence threshold τ, then the posterior class scores are used to label the flow as malicious. τ is set once at the validation set of seen classes bymaximizing the validation set macro F1, and kept fixed. We report the binary macro-F1 over the benign class and the held-out family as well as summarize ranking quality with the area under the precision recall curve and recall at a fixed 1% false positive rate standard in the heavy class imbalance of the zero-day setting.

In the same protocol, the results of the proposed model in comparison with CNN-GRU and single Transformer on the CICIoT2023 dataset is presented in figure 6 and table 10. Even held-out families contain significantly more macro-F1 under the proposed model on each family, which is especially notable on structurally different families, like denial-of-service and reconnaissance, where the multi-head fusion of cross-attention seems to carry over spatial-sequential regularities to variants not observed before. This is as expected, as performance on the unseen families is lower than the closed-set. However, the decline is much less pronounced than on the baselines, thus highlighting the graceful degradation of the dual-branch design to zero-day scenarios.

Table10 . Leave-one-attack-out macro-F1 on CICIoT2023, by held-out attack family (mean ± standard deviation over five seeds).

Figure6. . Zero-day macro-F1 under leave-one-attack-out evaluation on CICIoT2023.

4.8. Explainability Analysis

The global SHAP feature importance for the TON_IoT detector, which gives a list of the features by their mean absolute SHAP value. In line with the domain expectations, the most impactful features are derived from flow-duration and forward-packet-length statistics and counts of connection-flag. The features selected by the attention-rollout vector from the Transformer branch are closely similar, and consistency in the selection between the two signals suggest it is not a coincidence of some attribution method. Local explanations of the SHAP values for each individual flow also enable an analyst to view the reasons behind a given verdict, aiding in triage and incident response. This work’s explainability contribution is the post-hoc game-theoretic attribution, coupled with an intrinsic attention signal.

4.9. Discussion

The results suggest that the parallel spatial and sequential branches with cross-attention can jointly increase accuracy relative to either of the individual paradigm detectors (or the cascaded/concatenation-based hybrids), perform more gracefully in zero day conditions, and provide corroborated explanations. Several qualifications must be placed on these findings. The reported numbers are based on three metrics and would not necessarily translate to all IoT scenarios, the cross-attention module adds additional parameters as compared to a single branch (as quantified in Table 11), and when using the zero-day protocol, there is still simulated novelty in the form of out-of-range classes rather than real future attacks. These considerations, lead to the future work mentioned in the conclusion.

5. CONCLUSION AND FUTURE WORK

In this paper, a dual-branch Transformer-CNN-based intrusion detection model (IDM), namely, DB-TC-XAI, is presented which incorporates an explainability layer to explain the detection logic in the context of heterogeneous IoT networks. The model passes each flow through one 1D convolutional branch and a Transformer-encoder branch in parallel, complements the representations with a bi-directional cross-attention module, and avoids cascading – or concatenating – complementary spatial and sequential evidence that is so often diluted by cascaded and concatenated hybrids. To mitigate class imbalance, SMOTE-Tomek resampling is only performed in the ‘train’ fold, while the interpretability is provided by connecting the SHAP feature attributions with the attention rollout of Transformers, allowing the two explanation signals to support each other for an improved interpretation.

Evaluated across three heterogeneous benchmarks, DB-TC-XAI achieved competitive detection accuracy with a low false-positive rate, demonstrated less pronounced degradation than the reimplemented baselines under identical pipeline conditions, and exhibited markedly more graceful degradation under the leave-one-attack-out protocol that explicitly simulates zero-day conditions. Ablation experiments confirmed that both branches, the cross-attention fusion module, and the resampling stage each contribute meaningfully to overall performance, and the explainability analysis showed that SHAP attributions and attention-rollout scores agree on the most informative features.

Several directions for future work are identified. First, the model can be compressed through pruning, quantization, and knowledge distillation to meet the tightest edge deployment budgets while preserving the dual-branch advantage. Second, open-set recognition and few-shot adaptation mechanisms can be integrated with the zero-day evaluation protocol, reducing reliance on held-out class heuristics and enabling step-by-step identification of novel attack families. Third, federated learning could be applied across distributed IoT gateways, allowing the detector to train on decentralized traffic without aggregating sensitive telemetry from those distributed gateways. Lastly, by enriching the explainability layer with counterfactual and concept explanations would further assist analyst decision making in operational security, and the contexts.

CONFLICTS OF INTEREST

The authors declare no conflict of interest.

REFERENCES

[1] A. Jamalipour and S. Murali, (2022) “A taxonomy of machine-learning-based intrusion detection systems for the Internet of Things: a survey,” IEEE Internet of Things Journal, Vol. 9, No. 12, pp9444-9466.
[2] S. Arisdakessian, O. A. Wahab, A. Mourad, H. Otrok, and M. Guizani, (2023) “A survey on IoT intrusion detection: federated learning, game theory, social psychology, and explainable AI as future directions,” IEEE Internet of Things Journal, Vol. 10, No. 5, pp4059-4092.
[3] T. Saba, A. Rehman, T. Sadad, H. Kolivand, and S. A. Bahaj, (2022) “Anomaly-based intrusion detection system for IoT networks through deep learning model,” Computers and Electrical Engineering, Vol. 99, 107810.
[4] K. Albulayhi, A. A. Smadi, F. T. Sheldon, and R. K. Abercrombie, (2021) “IoT intrusion detection taxonomy, reference architecture, and analyses,” Sensors, Vol. 21, No. 19, 6432.
[5] A. Heidari and M. A. Jabraeil Jamali, (2023) “Internet of Things intrusion detection systems: a comprehensive review and future directions,” Cluster Computing, Vol. 26, pp3753-3780.
[6] M. A. Ferrag, L. Shu, O. Friha, and X. Yang, (2022) “Cyber security intrusion detection for agriculture 4.0: machine learning-based solutions, datasets, and future directions,” IEEE/CAA Journal of Automatica Sinica, Vol. 9, No. 3, pp407-436.
[7] R. Ahmad, R. Wazirali, and T. Abu-Ain, (2022) “Machine learning for wireless sensor networks security: an overview of challenges and issues,” Sensors, Vol. 22, No. 13, 4730.
[8] A. Deshmukh and K. Ravulakollu, (2024) “An efficient CNN-based intrusion detection system for IoT: use case towards cybersecurity,” Technologies, Vol. 12, No. 10, 203.
[9] E. U. H. Qazi, A. Almorjan, and T. Zia, (2022) “A one-dimensional convolutional neural network (1D-CNN) based deep learning system for network intrusion detection,” Applied Sciences, Vol. 12, No. 16, 7986.
[10] S. S. N. Chintapalli, et al., (2024) “OOA-modified Bi-LSTM network: an effective intrusion detection framework for IoT systems,” Heliyon, Vol. 10, e29410.
[11] A. M. Banaamah and I. Ahmad, (2022) “Intrusion detection in IoT using deep learning,” Sensors, Vol. 22, No. 21, 8417.
[12] A. Qaddos, M. U. Yaseen, A. S. Al-Shamayleh, M. Imran, A. Akhunzada, and S. Z. Alharthi, (2024) “A novel intrusion detection framework for optimizing IoT security,” Scientific Reports, Vol. 14, 21789.
[13] K. O. Adefemi, M. B. Mutanga, and O. A. Alimi, (2025) “A hybrid CNN-GRU deep learning model for IoT network intrusion detection,” Journal of Sensor and Actuator Networks, Vol. 14, No. 5, 96.
[14] R. Ben Said, Z. Sabir, and I. Askerzade, (2023) “CNN-BiLSTM: a hybrid deep learning approach for network intrusion detection system in SDN with hybrid feature selection,” IEEE Access, Vol. 11.
[15] B. Cao, C. Li, Y. Song, Y. Qin, and C. Chen, (2022) “Network intrusion detection model based on CNN and GRU,” Applied Sciences, Vol. 12, No. 9, 4184.
[16] C. Zhang, J. Li, N. Wang, and D. Zhang, (2025) “Research on intrusion detection method based on transformer and CNN-BiLSTM in Internet of Things,” Sensors, Vol. 25, No. 9, 2725.
[17] P. Sinha, D. Sahu, S. Prakash, T. Yang, R. S. Rathore, and V. K. Pandey, (2025) “A high performance hybrid LSTM CNN secure architecture for IoT environments using deep learning,” Scientific Reports, Vol. 15, 9684.
[18] M. Soltani, B. Ousat, M. Jafari Siavoshani, and A. H. Jahangir, (2023) “An adaptable deep learningbased intrusion detection system to zero-day attacks,” Journal of Information Security and Applications, Vol. 76, 103516.
[19] Z. Dai, L. Y. Por, Y.-L. Chen, J. Yang, C. S. Ku, R. Alizadehsani, and P. Plawiak, (2024) “An intrusion detection model to detect zero-day attacks in unseen data using machine learning,” PLoS ONE, Vol. 19, No. 9, e0308469.
[20] N. Moustafa, N. Koroniotis, M. Keshk, A. Y. Zomaya, and Z. Tari, (2023) “Explainable intrusion detection for cyber defences in the Internet of Things: opportunities and solutions,” IEEE Communications Surveys & Tutorials, Vol. 25, No. 3, pp1775-1807.
[21] Z. Zhang, H. Al Hamadi, E. Damiani, C. Y. Yeun, and F. Taher, (2022) “Explainable artificial intelligence applications in cyber security: state-of-the-art in research,” IEEE Access, Vol. 10, pp93104-93139.

[22] M. Keshk, N. Koroniotis, N. Pham, N. Moustafa, B. Turnbull, and A. Y. Zomaya, (2023) “An explainable deep learning-enabled intrusion detection framework in IoT networks,” Information Sciences, Vol. 639, 119000.
[23] T.-T.-H. Le, H. Kim, H. Kang, and H. Kim, (2022) “Classification and explanation for intrusion detection system based on ensemble trees and SHAP method,” Sensors, Vol. 22, No. 3, 1154.
[24] R. Younisse, A. Ahmad, and Q. Abu Al-Haija, (2022) “Explaining intrusion detection-based convolutional neural networks using Shapley additive explanations (SHAP),” Big Data and Cognitive Computing, Vol. 6, No. 4, 126.
[25] S. Bagui and K. Li, (2021) “Resampling imbalanced data for network intrusion detection datasets,” Journal of Big Data, Vol. 8, No. 6.
[26] K. G. R. Narayan, et al., (2024) “Attenuating majority attack class bias using hybrid deep learning based IDS framework,” Journal of Network and Computer Applications, Vol. 230, 103954.
[27] S. Akhtar, et al., (2025) “Intrusion detection in IoT network using temporal wavelet augmented deep dense and LSTM auto-encoders,” International Journal of Information Security, Vol. 24.
[28] A. Momand, S. U. Jan, and N. Ramzan, (2024) “ABCNN-IDS: attention-based convolutional neural network for intrusion detection in IoT networks,” Wireless Personal Communications, Vol. 136, No. 4, pp1981-2003.
[29] Z. Wang, H. Chen, S. Yang, X. Luo, D. Li, and J. Wang, (2023) “A lightweight intrusion detection method for IoT based on deep learning and dynamic quantization,” PeerJ Computer Science, Vol. 9, e1569.
[30] H. C. Altunay and Z. Albayrak, (2023) “A hybrid CNN+LSTM-based intrusion detection system for industrial IoT networks,” Engineering Science and Technology, an International Journal, Vol. 38, 101322.
[31] M. Jouhari and M. Guizani, (2024) “Lightweight CNN-BiLSTM based intrusion detection systems for resource-constrained IoT devices,” in Proc. IEEE IWCMC.
[32] Z. Wu, H. Zhang, P. Wang, and Z. Sun, (2022) “RTIDS: a robust transformer-based approach for intrusion detection system,” IEEE Access, Vol. 10, pp64375-64387.
[33] F. Ullah, S. Ullah, G. Srivastava, and J. C.-W. Lin, (2024) “IDS-INT: intrusion detection system using transformer-based transfer learning for imbalanced network traffic,” Digital Communications and Networks, Vol. 10, No. 1, pp190-204.
[34] L. D. Manocchio, S. Layeghy, W. W. Lo, G. K. Kulatilleke, M. Sarhan, and M. Portmann, (2024) “FlowTransformer: a transformer framework for flow-based network intrusion detection systems,” Expert Systems with Applications, Vol. 241, 122564.
[35] P. Liang, L. Yang, Z. Xiong, X. Zhang, and G. Liu, (2024) “Multilevel intrusion detection based on transformer and wavelet transform for IoT data security,” IEEE Internet of Things Journal (early access).
[36] H. Kamal and M. Mashaly, (2024) “Advanced hybrid transformer-CNN deep learning model for effective intrusion detection systems with class imbalance mitigation using resampling techniques,” Future Internet, Vol. 16, No. 12, 481.
[37] C. Xu, et al., (2025) “Few-shot network intrusion detection method based on multi-domain fusion and cross-attention,” PLOS ONE.
[38] A. Alabbadi, et al., (2025) “X-FuseRLSTM: a cross-domain explainable intrusion detection framework in IoT using attention-guided dual-path feature fusion and residual LSTM,” Sensors.
[39] I. Mbona and J. H. P. Eloff, (2022) “Detecting zero-day intrusion attacks using semi-supervised machine learning approaches,” IEEE Access, Vol. 10, pp69822-69838.
[40] B. I. Hairab, H. K. Aslan, M. S. Elsayed, A. D. Jurcut, and M. A. Azer, (2023) “Anomaly detection of zero-day attacks based on CNN and regularization techniques,” Electronics, Vol. 12, No. 3, 573.
[41] B. I. Hairab, M. S. Elsayed, A. D. Jurcut, and M. A. Azer, (2022) “Anomaly detection based on CNN and regularization techniques against zero-day attacks in IoT networks,” IEEE Access, Vol. 10, pp98427-98440.
[42] A. Amara Korba, A. Boualouache, and Y. Ghamri-Doudane, (2024) “Zero-X: a blockchain-enabled open-set federated learning framework for zero-day attack detection in IoV,” IEEE Transactions on Vehicular Technology, Vol. 73, No. 9, pp12399-12414.
[43] B. Sharma, L. Sharma, C. Lal, and S. Roy, (2024) “Explainable artificial intelligence for intrusion detection in IoT networks: a deep learning based approach,” Expert Systems with Applications, Vol. 238, 121751.

[44] Z. Abou El Houda, B. Brik, and L. Khoukhi, (2022) “Why should I trust your IDS?: an explainable deep learning framework for intrusion detection systems in Internet of Things networks,” IEEE Open Journal of the Communications Society, Vol. 3, pp1164-1176.
[45] O. Arreche, T. R. Guntur, J. W. Roberts, and M. Abdallah, (2024) “E-XAI: evaluating black-box explainable AI frameworks for network intrusion detection,” IEEE Access, Vol. 12, pp23954-23988.
[46] B. Nugraha, et al., (2025) “A versatile XAI-based framework for efficient and explainable intrusion detection systems,” Annals of Telecommunications.
[47] Z. Long, H. Yan, G. Shen, X. Zhang, H. He, and L. Cheng, (2024) “A transformer-based network intrusion detection approach for cloud security,” Journal of Cloud Computing, Vol. 13, No. 5.
[48] A. Alsaedi, N. Moustafa, Z. Tari, A. Mahmood, and A. Anwar, (2020) “TON_IoT telemetry dataset: a new generation dataset of IoT and IIoT for data-driven intrusion detection systems,” IEEE Access, Vol. 8, pp165130-165150. Dataset: https://research.unsw.edu.au/projects/toniot-datasets
[49] E. C. P. Neto, S. Dadkhah, R. Ferreira, A. Zohourian, R. Lu, and A. A. Ghorbani, (2023) “CICIoT2023: a real-time dataset and benchmark for large-scale attacks in IoT environment,” Sensors, Vol. 23, No. 13, 5941. Dataset: https://www.unb.ca/cic/datasets/iotdataset-2023.html
[50] N. Moustafa and J. Slay, (2015) “UNSW-NB15: a comprehensive data set for network intrusion detection systems,” in Proc. MilCIS, IEEE, pp1-6. Dataset: https://research.unsw.edu.au/projects/unsw-nb15-dataset
[51] Support Vector Regression to Predict Power Consumption, University of New Mexico, 2024.
[52] M. T. Sultan, H. El Sayed, and M. A. Khan, (2023) “An Intrusion Detection Mechanism for MANETS Based on Deep Learning Artificial Neural Networks (ANNS),” International Journal of Computer Networks and Communications (IJCNC), Vol. 15, No. 1. DOI: 10.5121/ijcnc.2023.15101.

AUTHORS

Prof. Rabins Porwal is a distinguished academic and researcher with 25+ years in AI, machine learning, data science, and software engineering. He heads the Department of Computer Applications at CSJMU, Kanpur, holds a Ph.D. in Software Engineering, has guided six doctoral scholars, published extensively, and actively contributes to professional societies like IEEE and ACM.

Dr. Anil Kumar Yadav is a seasoned academic, researcher, and administrator with 18+ years in computer science education and university governance. Currently Registrar at CCS University, Meerut, he earned his Ph.D. from MNNIT Allahabad. He has authored 30+ papers, won the Best Ph.D. Thesis Award, and advances research, digital initiatives, and academic excellence.

Mr. Shilpi Dubey is an experienced academic and management researcher with 21+ years in teaching and industry. An Assistant Professor at CSJMU, Kanpur, he specializes in marketing, management, and organizational behavior, with numerous research publications and active contributions to national and international academic forums.

Dr. Ashish Seth is a Professor at Inha University, Tashkent, with 20+ years in teaching, research, and consultancy. He holds a Ph.D. in Computer Science and has published 50+ papers, authored 5 books, and contributed to global projects including UNDP and Erasmus. His expertise spans AI, Blockchain, Cloud Computing, and Information Systems.