An Explainable Latent-Attention Hybrid Deep Learning Framework for High-Fidelity Intrusion Detection in IoT and Industrial Cyber Systems

The ever-increasing amount of diverse data being generated from the Internet of Things (IoT) and industrial cyber-physical systems is presenting new and significant challenges for intrusion detection through the use of Intrusion Detection Systems (IDS). This is due to many factors including the large volume of diverse data generated, rapid changes in attack behaviors, resource-constrained deployments on the Edge, as well as an increased need for transparency in AI-generated security decisions. Current machine learning and deep learning-based IDSs do not effectively generalize across multiple domain datasets nor are they capable of capturing long-range dependencies on the temporal dimension; they are also less explainable than other forms of defence and thus not suitable for real-time, high-fidelity defence solutions. To address these limitations, we propose an IDS called NOVA-XIDS (Novel Explainable Latent-Attention Hybrid Deep Learning Framework), which is a hybrid intrusion detection framework for symmetry across heterogeneous networks in both IoT and industrial networks. The NOVA-XIDS architecture collects the feature embeddings generated from a number of autoencoders, which were trained on the three benchmark datasets, into a global latent space, allowing for cross-dataset generalisation. The NOVA-XIDS framework leverages the combined use of multiple models, including a residual CNN with channel-spatial attention mechanisms included in the CBAM architecture, and long short-term memory (LSTM) networks for temporal modelling of attack behaviors, and self-attention models to effectively capture very precise attack signatures in the latent space. Our extensive testing and evaluation over the combined global test dataset of 1.95 million samples showed the performance of NOVA-XIDS to be 97.11% accurate, with strong weighted F1 performance and especially good minority-class detection performance. Furthermore, NOVA-XIDS provides transparency and is interpretable through the use of SHAP-based feature attributions, CBAM channel spatial attention visualization and LSTM network self-attention profiling. Finally, our ONNX-accelerated NOVA-XIDS is able to support real-time deployment and operational monitoring and is deployed through a Streamlit dashboard for the practitioner to gain immediate insight into security dangers that may be present within IoT systems. Thus, NOVA-XIDS establishes an interpretable, robust, edge-deployable and effective intrusion detection model that bridges multi dataset learning, hybrid attention modelling, and operational explainability.