A-THENA: Early Intrusion Detection for IoT with Time-Aware Hybrid Encoding and Network-Specific Augmentation

1. Problem Statement

The rapid proliferation of Internet of Things (IoT) devices has expanded attack surfaces, making these ecosystems highly vulnerable to sophisticated cyber threats (e.g., DDoS, brute-force attacks, malware). Existing Intrusion Detection Systems (IDS) face three critical challenges in this domain:

• Latency vs. Accuracy: Traditional feature-based IDS require observing entire network sessions to compute statistical features, delaying detection until an attack has already progressed.
• Temporal Aliasing: Most Deep Learning (DL) models, particularly Transformers, rely on discrete positional encodings (integer indices) that assume uniform packet spacing. This ignores the critical inter-arrival time between packets, which often distinguishes malicious traffic (e.g., rapid bursts in brute-force attacks) from benign traffic.
• Resource Constraints: IoT edge devices have limited processing power, memory, and energy, rendering heavy models or complex feature extraction pipelines impractical for real-time deployment.

2. Methodology

The authors propose A-THENA, a lightweight, end-to-end Early Intrusion Detection System (EIDS) that processes raw packet bytes directly, eliminating the need for manual feature engineering. The system is built on a Transformer-based architecture optimized for edge deployment.

Core Components:

• Time-Aware Hybrid Encoding (THE):
  • Instead of using discrete indices ($0, 1, \dots, n-1$), A-THENA replaces them with continuous packet timestamps ($t_0, t_1, \dots, t_{n-1}$).
  • It evaluates three time-aware encoding variants: Time-Aware Sinusoidal, Time-Aware Fourier, and Time-Aware Rotary Positional Encoding (RoPE).
  • The system dynamically selects the optimal encoding for a specific dataset by minimizing validation loss, acknowledging that different network traffic patterns require different temporal representations.
• Network-Specific Augmentation (NA):
  • To address data scarcity and class imbalance, the system employs a two-stage augmentation pipeline:
    1. Offline Augmentation: Generates "subflows" (prefixes of original flows) to simulate early detection scenarios and applies hybrid oversampling to balance classes.
    2. Online Augmentation: Applies real-time perturbations during training, including Jitter Injection (simulating network delay), Traffic Scaling (simulating speed variations), Packet Drop/Insertion, and Noise Injection. Crucially, these are applied to both packet bytes and timestamps to preserve temporal realism.
• Early Detection Loss (EDL):
  • A custom loss function that applies an exponentially decaying penalty based on flow length ($w_i = e^{-0.1 \cdot n_i}$). This forces the model to prioritize accurate classification on shorter flows (fewer packets), encouraging the model to learn discriminative features from the earliest possible data.
• Lightweight Architecture:
  • The model uses a single-layer Transformer encoder with a small hidden dimension ($d_m=8$) and 4 attention heads.
  • It processes raw bytes directly (after normalization) without intermediate feature extraction layers.

3. Key Contributions

1. A-THENA System: A complete, lightweight EIDS that integrates raw traffic processing, time-aware encoding, and specialized augmentation.
2. Time-Aware Hybrid Encoding (THE): A novel framework that replaces discrete positional indices with continuous timestamps across multiple encoding families (Sinusoidal, Fourier, RoPE), effectively capturing temporal dynamics and eliminating temporal aliasing.
3. Comprehensive Evaluation: The system is evaluated on three diverse benchmark datasets (CICIoT23-WEB, MQTT-IoT-IDS2020, and IoTID20), demonstrating robustness across web-based, protocol-specific, and botnet-driven attacks.
4. Edge Deployment Validation: The model is successfully deployed on a Raspberry Pi Zero 2 W, proving its feasibility for resource-constrained IoT environments with minimal latency and memory usage.
5. Ablation Studies: Rigorous analysis confirming the individual contributions of time-aware augmentation, the EDL loss function, and quantization.

4. Experimental Results

A-THENA was compared against traditional machine learning (ML) baselines, state-of-the-art time-aware encodings, and other early detection architectures.

• Accuracy Improvements:
  • Averaged across all datasets, A-THENA improved accuracy by 6.88% over the best traditional positional encoding, 3.69% over the strongest feature-based model, and 6.17% over leading time-aware alternatives.
  • It achieved 100% accuracy on CICIoT23-WEB and MQTT-IoT-IDS2020, and 93.83% on IoTID20.
• Earliness (Detection Speed):
  • A-THENA achieved confident predictions with as few as 1 packet (Earliness $E=1$) for two of the three datasets, whereas traditional feature-based methods required full flows ($E=30$).
  • It maintained near-zero False Alarm Rates (FAR) and False Negative Rates (FNR) across all datasets.
• Resource Efficiency (Raspberry Pi Zero 2 W):
  • Model Size: ~40 KB (significantly smaller than feature-based ensembles which can exceed 20 MB).
  • Memory Footprint: ~3.25 MB.
  • Latency: ~1.42 ms for a 30-packet flow. This is approximately 480x faster than traditional pipelines that rely on feature extraction (which incur ~664 ms of preprocessing delay).

5. Significance

• Paradigm Shift: A-THENA demonstrates that processing raw packet bytes with time-aware encodings outperforms traditional feature-engineering approaches, removing the latency bottleneck of statistical feature extraction.
• Temporal Intelligence: By treating network traffic as non-uniform time series rather than discrete sequences, the system effectively learns timing signatures (e.g., burstiness, periodicity) that are invisible to standard Transformers.
• Practical Viability: The successful deployment on a low-end Raspberry Pi proves that high-accuracy, real-time intrusion detection is feasible on edge devices, addressing a critical gap in IoT security where cloud-based solutions are often too slow or privacy-invasive.
• Generalizability: The hybrid encoding selection mechanism ensures the system adapts to the specific temporal characteristics of different network protocols and attack types, offering a unified solution for heterogeneous IoT environments.

In conclusion, A-THENA establishes a new standard for IoT security by combining architectural efficiency, temporal awareness, and robust data augmentation to deliver early, accurate, and resource-efficient threat detection.