Detecting cyber intrusions in modern IoT networks is challenging because of their large scale, heterogeneous device ecosystems, and high-volume traffic patterns. This paper presents a cross-attention CNN–LSTM fusion architecture that jointly learns the spatial and temporal characteristics of network traffic for binary intrusion detection. The proposed network combines a convolutional branch that extracts local feature interactions with a recurrent branch that captures sequential dependencies, and couples them through a bidirectional multi-head cross-attention module that allows each branch to selectively attend to information produced by the other. To strengthen generalization and mitigate overfitting, the architecture integrates Gaussian noise injection at the input, $$L_{2}$$ weight regularization, dropout, and label smoothing. The framework is evaluated on two recent benchmark datasets, ToN-IoT and CIC-IoT 2023, which together cover diverse IoT traffic scenarios and a wide range of contemporary attack types. Experimental results show that the proposed model attains 99.42% accuracy on ToN-IoT and 99.44% accuracy on CIC-IoT 2023, with AUC values of 0.9997 on ToN-IoT and 0.9988 on CIC-IoT 2023, consistently outperforming standalone CNN, standalone LSTM, and classical machine learning baselines, and achieving competitive or superior accuracy relative to several recent state-of-the-art hybrid models reported in the literature.

Deep learning intrusion detection systems perform well when traffic is merely separated into normal and malicious, but fine-grained recognition of the specific attack family remains difficult in Internet of Things (IoT) environments because of severe class imbalance and overlapping feature distributions. This work proposes an attention-enhanced CNN-BiLSTM fusion model for the multi-class classification of IoT attacks over eight families. A convolutional branch extracts local feature interactions, whereas a bidirectional Long Short-Term Memory (BiLSTM) branch reads the standardized flow descriptor as an ordered sequence and encodes dependencies among non-adjacent feature segments in both directions. Multi-head self-attention and a bidirectional cross-attention block let the two representations interact dynamically and suppress redundant information. Class imbalance is addressed with a focal loss and class-balanced weighting. The framework was evaluated on the large-scale CIC-IoT2023 benchmark under an eight-class taxonomy. On more than 3.5 × 10⁵ test flows, the proposed model reached 99.06% accuracy and a 98.99% weighted F1-score, outperforming standalone CNN, LSTM, CNN-LSTM, and CNN-BiLSTM baselines retrained on the same corrected data pipeline under an identical objective and budget.