Temporal-Spatial Feature Extraction in IoT-Based SCADA System Security: Hybrid CNN-LSTM and Attention-Based Architectures for Malware Classification and Attack Detection

This research presents a Convolutional Neural Network (CNN) and Long Short-Term Memory (LSTM) model developed for malware classification from IoT devices in the SCADA system and for detecting anomalies in the network. The developed model identifies complex attacks in the network by taking advantage of the strengths of CNNs that reveal spatial features and LSTMs that detect temporal dependency. CICIoT 2023 is used as the dataset. ADAM optimization algorithm with cross-entropy loss is used to eliminate overfitting and training is performed. Within the scope of the study, the proposed model is compared by applying it with six deep learning architectures (hybrid CNN-LSTM, Non-Local Neural Network (NLNN), Residual Attention Network (RAN), Dual Attention Network (DANet), Transformer-CNN and Attentional CNN). The obtained results show that the proposed CNN-LSTM model outperforms other complex architectures and achieves a high test accuracy of 99.23%. It has demonstrated remarkable performance according to precision, recall and F1 evaluation metrics in detecting distributed denial of service (DDoS) and denial of service (DoS) attacks. The proposed model successfully identifies Mirai botnet variants and fragmentation-based attacks. Although other models, Transformer-CNN (98.81%) and DANet (98.07%), provide high performance, they fall behind the superior temporal modeling capabilities of CNN-LSTM. When the obtained findings are examined, they highlight the relative strengths of various deep learning approaches for IoT security applications. The performances of the implemented deep learning models reached accuracies exceeding 96%, demonstrating the importance of IoT-based SCADA systems against evolving cyber threats. The study revealed the superior successes of deep learning-based approaches for IoT security.