ASTRID-Net: SE-enhanced triple attention deep learning framework for IoT and IIoT security

Why protecting smart devices matters

Homes, factories, hospitals, and power plants are filling up with smart devices that sense, measure, and control the world around us. This web of gadgets—often called the Internet of Things (IoT) and its industrial cousin, IIoT—brings convenience and efficiency, but it also opens countless digital doors for attackers. A single hacked sensor can help shut down production, steal medical data, or disrupt critical services. This study introduces ASTRID-Net, a new artificial-intelligence system designed to spot such intrusions in real time, even when attacks are rare, subtle, or constantly changing.

The growing problem of hidden attacks

Traditional security tools work like fingerprint databases: they look for known patterns of bad behavior. That approach fails when criminals invent new techniques, launch massive waves of traffic to overwhelm devices, or hide inside the normal chatter of a busy network. IoT and IIoT systems are especially exposed because they combine many different device types, run on low-power hardware, and often rely on simple communication rules. These constraints make it hard to install heavy security software and easy for attackers to blend in. As a result, organizations need smarter guards that can learn from experience, watch how traffic changes over time, and raise alarms when something feels off rather than only when it matches a stored signature.

A new AI guard for smart networks

ASTRID-Net (short for Adaptive Spatiotemporal Residual-Interpretable Detection Network) is built to meet these demands. Instead of relying on hand-crafted rules, it learns directly from real network records taken from a large, realistic benchmark called Edge-IIoTset. This dataset includes more than two million samples covering normal activity and 15 different attack types, from password guessing and port scanning to ransomware and various forms of distributed denial-of-service. ASTRID-Net turns each record into a sequence of numbers and processes it through several stages that mimic how a careful human analyst might work: first scanning for recognizable shapes in the data, then considering how events unfold over time, and finally concentrating attention on the most telling details.

How the system focuses on what matters

The first stage of ASTRID-Net uses several parallel pattern finders, each looking at the data through a different “window size.” This multi-scale view helps it catch both fine-grained clues, such as a sudden spike in a single field, and broader trends, such as a slow buildup of suspicious traffic. A special shortcut connection allows the system to keep useful low-level signals while it builds more complex ones, improving stability and training speed. Next, a bi-directional sequence module examines the order of events both forward and backward, capturing how packets before and after a moment relate to each other—important for spotting coordinated or staged attacks that play out over time.

Triple attention: time, channels, and space

ASTRID-Net’s most distinctive feature is its triple attention mechanism. One part learns which moments in a sequence are most important, so a brief but telling burst of strange traffic is not drowned out by long stretches of routine behavior. Another part, inspired by “squeeze-and-excitation” ideas, learns which types of signals—such as certain counts or timing measures—are most informative and amplifies them while muting less useful ones. The third part highlights informative positions across the combined feature map, helping the model concentrate on subtle patterns that are spread out rather than clustered. Together, these attention modules act like a spotlight that moves across time and feature space, allowing the system to focus processing power where it matters most.

What the results mean for everyday security

When tested on the Edge-IIoTset dataset, ASTRID-Net correctly distinguished normal traffic from attacks with up to 100% accuracy in simple “attack versus no attack” tasks and about 99.97% accuracy when identifying which of 15 attack types was present. Importantly, it performed well even on rare attack categories that many systems miss. For non-experts, this means the method offers a promising way to build smarter firewalls and monitoring tools that can protect smart homes, factories, and critical infrastructure with very few missed warnings or false alarms. While more work is needed to adapt it to privacy-preserving and fully distributed settings, ASTRID-Net points toward a future in which AI-driven security quietly watches over the growing universe of connected devices.

Citation: Zannat, A., Ahmmed, M.S., Hossain, M.A. et al. ASTRID-Net: SE-enhanced triple attention deep learning framework for IoT and IIoT security. Sci Rep 16, 5874 (2026). https://doi.org/10.1038/s41598-026-36731-8

Keywords: IoT security, intrusion detection, deep learning, industrial IoT, cyberattack detection