TIDE‐Net: A Two‐Stage Temporal Deep Learning Framework for Multi‐Granular IoT Intrusion Detection

ABSTRACT The rapid growth of the internet of things (IoT) has increased exposure to advanced cyberattacks. However, most existing intrusion detection systems (IDS) rely on outdated or synthetic datasets that do not reflect real deployment conditions. The recently released IDSIoT2024 dataset provides long‐term traffic traces from real IoT devices, allowing a more realistic evaluation of intrusion detection models. In this paper, we propose TIDE‐Net, a two‐stage temporal deep learning framework designed for the characteristics of IDSIoT2024. In Stage 1, the framework performs binary classification to separate benign and malicious traffic, whereas Stage 2 deals with the malicious traffic which is further classified into either three coarse‐grained attack categories or twelve fine‐grained attack types. Deep neural networks (DNN), one‐dimensional convolutional neural networks (CNN), and bidirectional long short‐term memory networks (BiLSTM) are evaluated under three settings: Binary, 3‐class, and 12‐class classification. Among these models, BiLSTM shows the most stable performance across all tasks. It achieves 99.24% accuracy in binary detection, over 98.7% accuracy in 3‐class classification, and a macro F1‐score of 0.914 in 12‐class classification. The proposed two‐stage BiLSTM‐based pipeline achieves approximately 97% end‐to‐end accuracy. It also handles class imbalance and temporal patterns more effectively than CNN and DNN baselines. These results provide one of the first comprehensive deep learning benchmarks on IDSIoT2024 and confirm the effectiveness of hierarchical, BiLSTM‐based temporal models for IoT intrusion detection.