A novel IOT intrusion detection system: Integrating features position encoder with a tab transformer deep learning model

Alsharaiah, M.; Almaiah, M.; Alqutaish, A.; Mamodiya, U.; Shehab, R.; Obeidat, M.

Abstract: Internet of Things (IoT) and Internet of Medical Things (IoMT) networks provide a massive amount of data. These types of data need a protection level, such as an intrusion detection framework. Deep learning models become a powerful tool for this purpose. Therefore, this work proposes an intrusion detection framework based on a deep learning technique which employs TabTransformer and self-attention mechanisms to imprison intricate dependencies among tabular features and detect abnormal attack behaviors. Precisely, each numerical feature is mapped into a learnable embedding vector and augmented with positional encodings to preserve feature identity and inter-feature relationships within the embedding space. The main task for the proposed model is to achieve binary classification tasks the model should classify the traffic data as either normal or abnormal. Furthermore, the model utilized a benchmark dataset such as the CICIoMT2024. Furthermore, this type of dataset faces issues, such as imbalance. So, the system integrates SMOTE-based data balancing, Stratified K-Fold Cross-Validation, and threshold optimization to ensure fairness and reproducibility to accomplish a binary classification task. As a consequence, experiments on the CICIoMT2024 dataset yield superior results, achieving a mean accuracy of 99.85. Through SHAP-based interpretability, key features influencing model predictions are identified, confirming the framework’s transparency, robustness, and suitability for real-world ARP intrusion detection.

How to cite this paper

        APA: Alsharaiah, M., Almaiah, M., Alqutaish, A., Mamodiya, U., Shehab, R & Obeidat, M. (2026). A novel IOT intrusion detection system: Integrating features position encoder with a tab transformer deep learning model. International Journal of Data and Network Science, 10(2), 677-688.
    

        Chicago/Turabian: Alsharaiah, M., Almaiah, M., Alqutaish, A., Mamodiya, U., Shehab, R & Obeidat, M. 2026. "A novel IOT intrusion detection system: Integrating features position encoder with a tab transformer deep learning model." International Journal of Data and Network Science 10, no. 2 (2026): 677-688.
    

        AMA: Alsharaiah, M., Almaiah, M., Alqutaish, A., Mamodiya, U., Shehab, R & Obeidat, M. A novel IOT intrusion detection system: Integrating features position encoder with a tab transformer deep learning model. International Journal of Data and Network Science. 2026;10(2):677-688.
    

References

Abu Laila, D. (2025). Responsive Machine Learning Framework and Lightweight Utensil of Prevention of Evasion Attacks in the IoT-Based IDS. STAP Journal of Security Risk Management, 2025(1), 59–70.
Addula, S. R., Norozpour, S., & Amin, M. (2025). Risk Assessment for Identifying Threats, vulnerabilities and countermeasures in Cloud Computing. Jordanian Journal of Informatics and Computing, 2025(1), 37-48.
Adeniyi, A. E., Olorunfemi, B. O., Jimoh, R. G., Olagunju, M., & Awotunde, J. B. (2024). Integrating convolutional neural networks and long short-term memory for enhanced detection of glaucoma. In Conference Organising Committee (p. 350).
Albinhamad, H., Alotibi, A., Alagnam, A., Almaiah, M., & Salloum, S. (2025). Vehicular Ad-hoc Networks (VANETs): A Key Enabler for Smart Transportation Systems and Challenges. Jordanian Journal of Informatics and Computing, 2025(1), 4-15.
Alboalebrah, M. R., & Al-augby, S. (2025). Unveiling the causes of fatal road accidents in Iraq: An association rule mining approach using the Apriori algorithm. Journal of Cyber Security and Risk Auditing, 2025(2), 1-11.
Al-Hassani, A., & Mohammed, S. (2023). A novel capsule network-based approach for detecting spoofing attacks in Internet of Medical Things systems. Iraqi Journal for Computer Science and Mathematics, 4, 45–56.
Ali, A. (2024). Adaptive and Context-Aware Authentication Framework Using Edge AI and Blockchain in Future Vehicular Networks. STAP Journal of Security Risk Management, 2024(1), 45–56. https://doi.org/10.63180/jsrm.thestap.2024.1.3
Almarshood, R., & Rahman, M. M. H. (2025). Enhancing Intrusion Detection Systems by Using Machine Learning in Smart Cities: Issues, Challenges and Future Research Direction. STAP Journal of Security Risk Management, 2025(1), 3–21.
Almedires, M. A., Elkhalil, A., & Amin, M. (2025). Adversarial attack detection in industrial control systems using LSTM-based intrusion detection and black-box defense strategies. Journal of Cyber Security and Risk Auditing, 2025(3), 4-22.
Al-Na’amneh, Q., Aljawarneh, M., Alhazaimeh, A. S., Hazaymih, R., & Shah, S. M. (2025). Securing Trust: Rule-Based Defense Against On/Off and Collusion Attacks in Cloud Environments. STAP Journal of Security Risk Management, 2025(1), 85–114. https://doi.org/10.63180/jsrm.thestap.2025.1.5
Alshinwan, M., Memon, A. G., Ghanem, M. C., & Almaayah, M. (2025). Unsupervised text feature selection approach based on improved Prairie dog algorithm for the text clustering. Jordanian Journal of Informatics and Computing, 2025(1), 27-36.
Amirruddin, A. D., Muharam, F. M., Ismail, M. H., Tan, N. P., & Ismail, M. F. (2022). Synthetic minority over-sampling technique (SMOTE) and logistic model tree–adaptive boosting algorithms for classifying imbalanced datasets. Computers and Electronics in Agriculture, 193, 106646.
Ang, S., Ho, M., Huy, S., & Janarthanan, M. (2026). A Multi-Layered Adaptive Cybersecurity Framework for the Banking Sector Integrating Next-Gen Firewalls with AI-Driven IDPS. STAP Journal of Security Risk Management, 2026(1), 67–76. https://doi.org/10.63180/jsrm.thestap.2026.1.4
Bhosale, K. S., Nenova, M., & Iliev, G. (2021). A study of cyber attacks in the healthcare sector. In Proceedings of the Sixth Junior Conference on Lighting (pp. 1–6). IEEE.
Cabello-Solorzano, K., Ortigosa de Araujo, I., Peña, M., Correia, L., & Tallón-Ballesteros, A. J. (2023). The impact of data normalization on the accuracy of machine learning algorithms: A comparative analysis. In International Conference on Soft Computing (pp. 344–353). Springer.
Davarasan, A., Samual, J., Palansundram, K., & Ali, A. (2024). A Comprehensive Review of Machine Learning Approaches for Android Malware Detection. Journal of Cyber Security and Risk Auditing, 2024(1), 38-60.
Elreedy, D., Atiya, A. F., & Kamalov, F. (2024). A theoretical distribution analysis of synthetic minority oversampling technique (SMOTE) for imbalanced learning. Machine Learning, 113(7), 4903–4923.
Farooq, F., Mohammad, S. S., Nazir, N. A., & Shah, P. A. (2024). Happiness at work: A systematic literature review. International Journal of Organizational Analysis, 32(10), 2236–2255.
Farooqui, M., Zaidat, O. O., Hassan, A. E., Quispe-Orozco, D., Petersen, N., Divani, A. A., & Ortega-Gutierrez, S. (2023). Functional and safety outcomes of carotid artery stenting and mechanical thrombectomy for large vessel occlusion ischemic stroke. JAMA Network Open, 6(3), e230736.
Fourure, D., Javaid, M. U., Posocco, N., & Tihon, S. (2021). Anomaly detection: How to artificially increase your F1-score with a biased evaluation protocol. In Joint European Conference on Machine Learning and Knowledge Discovery in Databases (pp. 3–18). Springer.
Frederick, N., & Ali, A. (2024). Enhancing DDoS Attack Detection and Mitigation in SDN Using Advanced Machine Learning Techniques. Journal of Cyber Security and Risk Auditing, 2024(1), 23-37.
Gheni, H. Q., & Al-Yaseen, W. L. (2024). Using CICIoMT2024 dataset for improved intrusion detection. In International Conference on Data Analytics & Management (pp. 285–301). Springer Nature.
Hairani, H., Widiyaningtyas, T., & Prasetya, D. D. (2024). Addressing class imbalance of health data: A systematic literature review on modified SMOTE strategies. JOIV: International Journal on Informatics Visualization, 8(3), 1310–1318.
He, B., & Zhang, J. (2023). An association rule mining method based on named entity recognition and text classification. Arabian Journal for Science and Engineering, 48(2), 1503–1511.
Huang, C., Li, S. X., Caraballo, C., Masoudi, F. A., Rumsfeld, J. S., Spertus, J. A., & Krumholz, H. M. (2021). Performance metrics for the comparative analysis of clinical risk prediction models employing machine learning. Circulation: Cardiovascular Quality and Outcomes, 14(10), e007526.
Iqbal, A., Aman, M. N., & Sikdar, B. (2024). A deep learning-based induced GNSS spoof detection framework. IEEE Transactions on Machine Learning in Communications and Networking, 2, 457–478.
Jaafar, H. S., Abed, A. A., & Al-Shareeda, M. A. (2026). A Secure Industrial Internet of Things (IIoT) Framework for Real-Time PI Control and Cloud-Integrated Industrial Monitoring. STAP Journal of Security Risk Management, 2026(1), 77–86. https://doi.org/10.63180/jsrm.thestap.2026.1.5
Jayaraj, I. A., Shanmugam, B., Azam, S., & Thennadil, S. (2024). Detecting and localizing wireless spoofing attacks on the Internet of Medical Things. Journal of Sensor and Actuator Networks, 13(6), 72. https://doi.org/10.3390/jsan13060072
Kadhim, R., & Al-Bahadili, H. (2024). Enhancing security in IoMT using deep learning: A capsule network framework for spoofing attack detection. Iraqi Journal for Computer Science and Mathematics, 5(1), 30–42.
Kommisetty, P. D. N. K., Kuppala, B. M. S. R., & Buvvaji, H. V. (2022). Transforming cyber defense: Anomaly detection and predictive analytics for automated threat response. International Journal of Engineering and Computer Science, 11(8), 1–10.
Lippi, G., Aljawarneh, M., Al-Na’amneh, Q., Hazaymih, R., & Dhomeja, L. D. (2025). Security and privacy challenges and solutions in autonomous driving systems: A comprehensive review. Journal of Cyber Security and Risk Auditing, 2025(3), 23-41.
Lourenço, B., Adão, P., Ferreira, J. F., Marques, M. M., & Vaz, C. (2025). Structuring security: A survey of cybersecurity ontologies, semantic log processing, and LLM applications. arXiv preprint arXiv:2510.16610.
Lv, Z., Ding, H., Wang, L., & Zou, Q. (2021). A convolutional neural network using dinucleotide one-hot encoder for identifying DNA N6-methyladenine sites in the rice genome. Neurocomputing, 422, 214–221.
Majumder, S., Deb Barma, M. K., & Saha, A. (2025). ARP spoofing detection using machine learning classifiers: An experimental study. Knowledge and Information Systems, 67(1), 727–766.
Mohammadpour, L., Ling, T. C., Liew, C. S., & Aryanfar, A. (2022). A survey of CNN-based network intrusion detection. Applied Sciences, 12(16), 8162.
Newaz, A. I., Sikder, A. K., Rahman, M. A., & Uluagac, A. S. (2021). A survey on security and privacy issues in modern healthcare systems: Attacks and defenses. ACM Transactions on Computing for Healthcare, 2(3), 1–44. https://doi.org/10.1145/3453175
Prusty, S., Patnaik, S., & Dash, S. K. (2022). SKCV: Stratified K-fold cross-validation on ML classifiers for predicting cervical cancer. Frontiers in Nanotechnology, 4, 972421.
Rahmanzadehgervi, P., Nguyen, H. H., Liu, R., Mai, L., & Nguyen, A. T. (2025). TAB: Transformer attention bottlenecks enable user intervention and debugging in vision-language models. In Proceedings of the IEEE/CVF International Conference on Computer Vision.
Ramesh, H., Ismail, N., Abd Rahman, N. A., & Ali, A. (2026). PhishGuard: AI-Driven Graph-Based Analysis for Smarter Email Security. STAP Journal of Security Risk Management, 2026(1), 31–45. https://doi.org/10.63180/jsrm.thestap.2026.1.2
Saheed, Y. K., & Arowolo, M. O. (2021). Efficient cyber attack detection on the Internet of Medical Things smart environment based on deep recurrent neural networks and machine learning algorithms. IEEE Access, 9, 161546–161554.
Sharma, A., & Babbar, H. (2024). Preventing spoofing threats in IoT: Machine learning approaches for intrusion detection. In Proceedings of the IEEE 3rd World Conference on Applied Intelligence and Computing (AIC) (pp. 1267–1271). IEEE.
Testas, A. (2023). Support vector machine classification with Pandas, scikit-learn, and PySpark. In Distributed Machine Learning with PySpark (pp. 259–280). Apress.
Yadav, R., Pradeepa, P., Srinivasan, S., Rajora, C. S., & Rajalakshmi, R. (2024). A novel healthcare framework for ambient assisted living using the Internet of Medical Things (IoMT) and deep neural networks. Measurement: Sensors, 33, 101111. https://doi.org/10.1016/j.measen.2024.101111
Zachos, G., Essop, I., Mantas, G., Porfyrakis, K., Ribeiro, J. C., & Rodriguez, J. (2021). An anomaly-based intrusion detection system for Internet of Medical Things networks. Electronics, 10(21), 2562.