{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,9,29]],"date-time":"2026-09-29T04:59:37Z","timestamp":1790657977184,"version":"4.1.0"},"reference-count":48,"publisher":"Frontiers Media SA","license":[{"start":{"date-parts":[[2026,9,29]],"date-time":"2026-09-29T00:00:00Z","timestamp":1790640000000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"content-domain":{"domain":["frontiersin.org"],"crossmark-restriction":true},"short-container-title":["Front. Artif. Intell."],"abstract":"<jats:sec>\n                    <jats:title>Introduction<\/jats:title>\n                    <jats:p>The rapid and pervasive growth of Internet of Things (IoT) devices has significantly expanded the attack surface of current network environments, making them vulnerable to advanced and evolving cyber threats. However, current intrusion detection systems (IDS) usually suffer from weak cross-domain generalization, high false positive rates, and poor performance against novel attacks.<\/jats:p>\n                  <\/jats:sec>\n                  <jats:sec>\n                    <jats:title>Methods<\/jats:title>\n                    <jats:p>To overcome these issues, this paper proposes TL-CRANN, a transfer-learning-based hybrid deep learning framework utilizing a convolutional neural network (CNN), bidirectional long short-term memory (Bi-LSTM), and a multi-head self-attention mechanism for cross-domain IoT attack detection. Transfer learning is leveraged to transfer knowledge acquired from source-domain traffic and achieve rapid adaptation to heterogeneous target IoT environments with scarce labeled data. The proposed model is evaluated using three benchmark datasets: CICIDS2017, TON_IoT, and Bot-IoT.<\/jats:p>\n                  <\/jats:sec>\n                  <jats:sec>\n                    <jats:title>Results<\/jats:title>\n                    <jats:p>Experimental results show that TL-CRANN achieved detection accuracies of 98.37%, 96.21%, and 97.14%, respectively, on the three datasets, and significantly outperformed existing state-of-the-art machine learning and deep learning baselines.<\/jats:p>\n                  <\/jats:sec>\n                  <jats:sec>\n                    <jats:title>Discussion<\/jats:title>\n                    <jats:p>The results show that transfer learning improves the cross-domain detection performance and training cost. Moreover, the ablation analysis shows that CNN, Bi-LSTM and attention mechanisms-based modules are contribution to effectiveness of proposed framework which also confirms the applicability of TL-CRANN for cross-domain IoT attack detection.<\/jats:p>\n                  <\/jats:sec>","DOI":"10.3389\/frai.2026.1934604","type":"journal-article","created":{"date-parts":[[2026,9,29]],"date-time":"2026-09-29T04:40:39Z","timestamp":1790656839000},"update-policy":"https:\/\/doi.org\/10.3389\/crossmark-policy","source":"Crossref","is-referenced-by-count":0,"title":["TL-CRANN: a transfer-learning-based hybrid CNN-RNN model with attention mechanism for cross-domain IoT attack detection"],"prefix":"10.3389","volume":"9","author":[{"given":"L. Sankar","family":"Ganesh","sequence":"first","affiliation":[{"name":"School of Computer Science and Engineering (SCOPE), Vellore Institute of Technology, Vellore","place":["Tamil Nadu, India"]}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"P. Mohan","family":"Kumar","sequence":"additional","affiliation":[{"name":"School of Computer Science and Engineering (SCOPE), Vellore Institute of Technology, Vellore","place":["Tamil Nadu, India"]}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"1965","published-online":{"date-parts":[[2026,9,29]]},"reference":[{"key":"B1","doi-asserted-by":"publisher","first-page":"116","DOI":"10.3390\/bdcc8090116","article-title":"Attention-driven transfer-learning model for improved IoT intrusion detection","volume":"8","author":"Abdelhamid","year":"2024","journal-title":"Big Data Cognitive Comput"},{"key":"B2","doi-asserted-by":"publisher","first-page":"3693","DOI":"10.3390\/s25123693","article-title":"X-FuseRLSTM: a cross-domain explainable intrusion detection framework in IoT using the attention-guided dual-path feature fusion and residual LSTM","volume":"25","author":"Alabbadi","year":"2025","journal-title":"Sensors"},{"key":"B3","doi-asserted-by":"publisher","first-page":"21856","DOI":"10.1038\/s41598-025-07706-y","article-title":"Deep learning for network security: an attention-CNN-LSTM model for accurate intrusion detection","volume":"15","author":"Alashjaee","year":"2025","journal-title":"Sci. Rep."},{"key":"B4","doi-asserted-by":"publisher","first-page":"3155","DOI":"10.19139\/soic-2310-5070-3226","article-title":"Assessing LSTM and GRU for multi-dataset intrusion detection in IoT environments","volume":"15","author":"Alayash","year":"2026","journal-title":"Statistics Optimization Info. Comput."},{"key":"B5","doi-asserted-by":"publisher","DOI":"10.1111\/exsy.13726","article-title":"A comprehensive survey on deep learning-based intrusion detection systems in Internet of Things (IoT)","author":"Al-Haija","year":"2025","journal-title":"Expert Syst."},{"key":"B6","doi-asserted-by":"publisher","first-page":"9691","DOI":"10.3390\/app15179691","article-title":"A survey of cross-layer security for resource-constrained IoT devices. Appl. Sci.","author":"Altaibek","year":"2025"},{"key":"B7","doi-asserted-by":"publisher","first-page":"101322","DOI":"10.1016\/j.jestch.2022.101322","article-title":"A hybrid CNN+LSTM-based intrusion detection system for industrial IoT networks","volume":"38","author":"Altunay","year":"2023","journal-title":"Eng. Sci. Technol. Int. J."},{"key":"B8","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1080\/09540091.2025.2599708","article-title":"Enhancing generalization of cross-domain intrusion detection: a heterogeneous deep stacked ensemble approach","volume":"38","author":"Amin","year":"2025","journal-title":"Connection Sci."},{"key":"B9","doi-asserted-by":"publisher","DOI":"10.1145\/3474369.3486864","article-title":"INSOMNIA: towards concept-drift robustness in network intrusion detection","author":"Andresini","year":"2021","journal-title":"Proceedings of the 14th ACM workshop on artificial intelligence and security"},{"key":"B10","doi-asserted-by":"publisher","first-page":"8417","DOI":"10.3390\/s22218417","article-title":"Intrusion detection in IoT using deep learning","volume":"22","author":"Banaamah","year":"2022","journal-title":"Sensors."},{"key":"B11","doi-asserted-by":"publisher","first-page":"287","DOI":"10.1109\/CSR64739.2025.11130005","article-title":"\u201cFrom one network to another: transfer-learning for IoT malware detection,\u201d","volume":"2025","author":"Bosinaki","year":"2025","journal-title":"2025 IEEE international conference on cyber security and resilience (CSR)"},{"key":"B12","doi-asserted-by":"publisher","first-page":"343","DOI":"10.32604\/jcs.2025.067979","article-title":"Deep learning-driven intrusion detection and defense mechanisms: a novel approach to mitigating cyber attacks,\u201d","volume":"7","author":"Cheng","year":"2025","journal-title":"J. Cyber Security."},{"key":"B13","doi-asserted-by":"publisher","first-page":"100699","DOI":"10.1016\/j.iot.2023.100699","article-title":"A deep learning approach for intrusion detection in internet of things using focal loss function","volume":"22","author":"Dina","year":"2023","journal-title":"Internet of Things"},{"key":"B14","doi-asserted-by":"publisher","first-page":"194","DOI":"10.3390\/fi18040194","article-title":"Cross-dataset temporal and semantic generalization of intrusion detection models for the future internet","volume":"18","author":"Elangovan","year":"2026","journal-title":"Future Internet"},{"key":"B15","doi-asserted-by":"publisher","first-page":"24098","DOI":"10.1038\/s41598-025-10561-6","article-title":"GCSA-ResNet: a deep neural network architecture for malware detection","volume":"15","author":"Fan","year":"2025","journal-title":"Sci. Rep."},{"key":"B16","doi-asserted-by":"publisher","first-page":"4342","DOI":"10.1109\/OJCOMS.2025.3569301","article-title":"Deep transfer learning based on hybrid SWIN transformers with LSTM for intrusion detection systems in IoT environment","volume":"6","author":"Fares","year":"2025","journal-title":"IEEE Open J. Communications Society."},{"key":"B17","doi-asserted-by":"publisher","first-page":"40281","DOI":"10.1109\/ACCESS.2022.3165809","article-title":"Edge-IIOTSET: a new comprehensive realistic cyber security dataset of IoT and IIoT applications for centralized and federated learning","volume":"10","author":"Ferrag","year":"2022","journal-title":"IEEE"},{"key":"B18","doi-asserted-by":"publisher","first-page":"981","DOI":"10.3390\/electronics15050981","article-title":"Efficient CNN\u2013GRU transfer-learning for edge IoT intrusion detection","volume":"15","author":"Gamlo","year":"2026","journal-title":"Electronics"},{"key":"B19","doi-asserted-by":"publisher","first-page":"3571","DOI":"10.3390\/s24113571","article-title":"Systematic literature review of IoT botnet DDOS attacks and evaluation of detection techniques.","volume":"24","author":"Gelgi","year":"2024","journal-title":"Sensors"},{"key":"B20","doi-asserted-by":"publisher","first-page":"44624","DOI":"10.1038\/s41598-025-32697-1","article-title":"A novel deep learning framework with temporal attention convolutional networks for intrusion detection in IoT IIoT networks.","volume":"15","author":"Ghosh","year":"2025","journal-title":"Sci. Rep."},{"key":"B21","doi-asserted-by":"publisher","first-page":"2","DOI":"10.14569\/IJACSA.2024.0151204","article-title":"An enhanced real-time intrusion detection framework using federated transfer learning in large-scale IoT networks","volume":"15","author":"Harahsheh","year":"2024","journal-title":"Int. J. Adv. Comput. Sci. Appl."},{"key":"B22","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1109\/ICKECS70176.2026.11527696","article-title":"\u201cCost-sensitive long-tail intrusion detection with imbalance-aware learning and SOC-oriented evaluation,\u201d","volume-title":"2026 4th international conference on knowledge engineering and communication systems (ICKECS)","author":"Hemalatha","year":"2026"},{"key":"B23","doi-asserted-by":"publisher","first-page":"567","DOI":"10.3390\/s22020567","article-title":"Preventing MQTT vulnerabilities using IoT-enabled intrusion detection system.","volume":"22","author":"Husnain","year":"2022","journal-title":"Sensors"},{"key":"B24","doi-asserted-by":"publisher","first-page":"2370","DOI":"10.3390\/electronics13122370","article-title":"Insights into modern intrusion detection strategies for internet of things ecosystems.","volume":"13","author":"Isong","year":"2024","journal-title":"Electronics."},{"key":"B25","doi-asserted-by":"publisher","first-page":"834","DOI":"10.3390\/pr9050834","article-title":"HCRNNIDS: hybrid convolutional recurrent neural network-based network intrusion detection system","volume":"9","author":"Khan","year":"2021","journal-title":"Processes."},{"key":"B26","doi-asserted-by":"publisher","DOI":"10.1007\/s40009-025-01891-0","article-title":"Optimizing IoT intrusion detection: a comparative study of ensemble-based models and deep learning techniques","author":"Kumar","year":"2025","journal-title":"Nat. Acad. Sci. Letters"},{"key":"B27","doi-asserted-by":"publisher","first-page":"681","DOI":"10.1109\/TNSM.2025.3617765","article-title":"Adaptive NetFlow IIOT intrusion detection with deep transfer learning, genetic optimization, and ensemble methods for network management","volume":"23","author":"Li","year":"2025","journal-title":"IEEE Transactions on Netw. Serv. Manag."},{"key":"B28","doi-asserted-by":"publisher","DOI":"10.1145\/3485447.3512217","author":"Lin","year":"2022","journal-title":"ET-BERT: A Contextualized Datagram Representation with Pre-training Transformers for Encrypted Traffic Classification"},{"key":"B29","doi-asserted-by":"publisher","first-page":"719","DOI":"10.1016\/j.ins.2023.02.031","article-title":"An adversarial domain adaptation approach combining dual domain pairing strategy for IoT intrusion detection under few-shot samples","volume":"629","author":"Ma","year":"2023","journal-title":"Info. Sci."},{"key":"B30","doi-asserted-by":"publisher","first-page":"109542","DOI":"10.1016\/j.knosys.2022.109542","article-title":"ITL-IDS: incremental transfer-learning for intrusion detection systems","volume":"253","author":"Mahdavi","year":"2022","journal-title":"Knowledge-Based Syst"},{"key":"B31","doi-asserted-by":"publisher","DOI":"10.1007\/s43926-025-00099-4","article-title":"Advancements in training and deployment strategies for AI-based intrusion detection systems in IoT: a systematic literature review. Discover Internet of Things","author":"Mallidi","year":"2025"},{"key":"B32","doi-asserted-by":"publisher","first-page":"1251","DOI":"10.1007\/s10207-023-00787-8","article-title":"TL-BI-LSTM IoT: transfer-learning model for prediction of intrusion detection system in IoT environment","volume":"23","author":"Nandanwar","year":"2023","journal-title":"Int. J. Informat Security"},{"key":"B33","doi-asserted-by":"publisher","first-page":"111108","DOI":"10.1016\/j.compeleceng.2026.111108","article-title":"An empirical study of Hy-BiLSTM-Tr and AE-GRU deep learning models for intrusion detection","volume":"134","author":"Nayak","year":"2026","journal-title":"Comput. Electrical Eng."},{"key":"B34","doi-asserted-by":"publisher","first-page":"442","DOI":"10.3390\/info12110442","article-title":"Analysis of gradient vanishing of RNNs and performance comparison","volume":"12","author":"Noh","year":"2021","journal-title":"Information"},{"key":"B35","doi-asserted-by":"publisher","first-page":"57322","DOI":"10.1109\/ACCESS.2025.3555861","volume":"13","author":"Phalaagae","year":"2025"},{"key":"B36","doi-asserted-by":"publisher","first-page":"1397480","DOI":"10.3389\/frai.2024.1397480","article-title":"Exploring security threats and solutions techniques for Internet of things (IoT): from vulnerabilities to vigilance","volume":"7","author":"Sahu","year":"2024","journal-title":"Front. Artificial Intelligence"},{"key":"B37","doi-asserted-by":"publisher","first-page":"5503","DOI":"10.1007\/s11276-020-02340-0","article-title":"Review of security challenges in healthcare internet of things","volume":"27","author":"Somasundaram","year":"2020","journal-title":"Wireless Netw."},{"key":"B38","doi-asserted-by":"publisher","first-page":"114590","DOI":"10.1109\/ACCESS.2023.3324657","article-title":"MAGRU-IDS: a multi-head attention-based gated recurrent unit for intrusion detection in IIoT networks","volume":"11","author":"Ullah","year":"2023","journal-title":"IEEE Access."},{"key":"B39","doi-asserted-by":"publisher","first-page":"28718","DOI":"10.1038\/s41598-025-11348-5","article-title":"Network intrusion detection model using wrapper based feature selection and multi head attention transformers","volume":"15","author":"Umer","year":"2025","journal-title":"Sci. Rep."},{"key":"B40","first-page":"5998","article-title":"\u201cAttention Is all you need,\u201d","author":"Vaswani","year":"2017","journal-title":"Proc. 31st Conf. neural information processing systems (NeurIPS)"},{"key":"B41","doi-asserted-by":"publisher","DOI":"10.1080\/24751839.2026.2640249","article-title":"A deep learning-based IDS for IoT: model proposal and comparative study of dataset balancing techniques","author":"Villafranca","year":"2026","journal-title":"J. Info. Telecommunication"},{"key":"B42","doi-asserted-by":"publisher","first-page":"41525","DOI":"10.1109\/ACCESS.2019.2895334","article-title":"Deep learning approach for intelligent intrusion detection system","volume":"7","author":"Vinayakumar","year":"2019","journal-title":"IEEE Access"},{"key":"B43","doi-asserted-by":"publisher","first-page":"283","DOI":"10.3390\/computers14070283","article-title":"Comparative analysis of deep learning models for intrusion detection in IoT networks","volume":"14","author":"Waqas","year":"2025","journal-title":"Computers"},{"key":"B44","doi-asserted-by":"publisher","first-page":"239","DOI":"10.1109\/TSC.2024.3505785","article-title":"Learning-to-adaptation for security service in industrial IoT: an AI-enabled slice-specific solution","volume":"18","author":"Wei","year":"2025","journal-title":"IEEE Trans. Serv. Comput."},{"key":"B45","doi-asserted-by":"publisher","first-page":"483","DOI":"10.32604\/jcs.2025.071627","article-title":"Cross-dataset transformer-IDS with calibration and AUC optimization (evaluated on NSL-KDD, UNSW-NB15, CIC-IDS2017)","volume":"7","author":"Xin","year":"2025","journal-title":"J Cyber Security"},{"key":"B46","doi-asserted-by":"publisher","first-page":"91357","DOI":"10.1109\/ACCESS.2024.3418995","article-title":"Internet of Things (IoT): origins, embedded technologies, smart applications, and its growth in the last decade","volume":"12","author":"Yalli","year":"2024","journal-title":"IEEE Access"},{"key":"B47","doi-asserted-by":"publisher","first-page":"4170","DOI":"10.3390\/electronics12194170","article-title":"A network intrusion detection model based on bi-LSTM with multi-head attention mechanism","volume":"12","author":"Zhang","year":"2023","journal-title":"Electronics."},{"key":"B48","doi-asserted-by":"publisher","first-page":"43","DOI":"10.1109\/jproc.2020.3004555","article-title":"A comprehensive survey on transfer learning","volume":"109","author":"Zhuang","year":"","journal-title":"Proc. IEEE"}],"container-title":["Frontiers in Artificial Intelligence"],"original-title":[],"link":[{"URL":"https:\/\/www.frontiersin.org\/articles\/10.3389\/frai.2026.1934604\/full","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,9,29]],"date-time":"2026-09-29T04:40:45Z","timestamp":1790656845000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.frontiersin.org\/articles\/10.3389\/frai.2026.1934604\/full"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,9,29]]},"references-count":48,"alternative-id":["10.3389\/frai.2026.1934604"],"URL":"https:\/\/doi.org\/10.3389\/frai.2026.1934604","relation":{},"ISSN":["2624-8212"],"issn-type":[{"value":"2624-8212","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,9,29]]},"article-number":"1934604"}}