RT info:eu-repo/semantics/article
T1 Transformer-based classification of IoT network traffic with flow-to-window aggregation
A1 Martin Reizabal, Sergio
A1 Caballero Quiroga, Adrian
A1 Gil Arroyo, Beatriz
A1 Basurto Hornillos, Nuño
A1 Ruiz González, Rubén
K1 Internet of things (IoT)
K1 Network traffic classification
K1 Intrusion detection system (IDS)
K1 Transformer
K1 Self-attention
K1 Deep learning
K1 Internet de los objetos
K1 Internet of things
K1 Computación ubicua
K1 Ubiquitous computing
AB The explosive growth of the IoT has led to an increasingly complex and heterogeneous network traffic, posing major challenges for intrusion detection. Most existing machine learning and deep learning approaches model network traffic at the level of individual flows, which limits their ability to capture contextual relationships among concurrent communications. This paper introduces a Transformer-based framework for IoT intrusion detection that aggregates network flows into fixed-duration windows and treats each flow as a token within the input sequence. The self-attention mechanism captures contextual relationships among concurrent flows, enabling effective modeling of temporal dependencies without recurrence. Experiments conducted on the CICIoT2023 dataset show that the proposed model achieves a weighted F1-score of 97.9% and a macro ROC–AUC of 99.6% under temporally blocked cross-validation, while maintaining high computational efficiency. These results demonstrate that flow-to-window aggregation combined with self-attention provides a robust and scalable foundation for IoT network security, suitable for deployment in edge and smart-home environments.
PB Elsevier
SN 2542-6605
YR 2026
FD 2026-03
LK https://hdl.handle.net/10259/11860
UL https://hdl.handle.net/10259/11860
LA eng
DS Repositorio Institucional de la Universidad de Burgos
RD 19-jun-2026