A Real-Time Channel-Level Intrusion Detection System Based on Multimodal Learning

With the proliferation of Internet of Things (IoT) devices, cybersecurity threats are escalating. To protect user privacy and data integrity, a significant portion of IoT traffic is secured using encryption technologies. Additionally, certain IoT scenarios demand that Intrusion Detection Systems (IDS) process traffic in real-time. Thus, encrypted flow detection and real-time detection have emerged as two core challenges for IDS in IoT. To address these challenges, this paper proposes RCML-IDS, a Real-time Channel-level Intrusion Detection System based on Multimodal Learning. The core novelty of RCML-IDS lies in its real-time, online processing capability, enabled by a time-window-based traffic preprocessing mechanism. Additionally, it performs channel-level traffic aggregation and integrates multi-modal features, namely raw bytes and packet lengths, to capture rich behavioral patterns from encrypted traffic. Architecturally, two Transformers learn multi-level byte representations from local to global contexts, while an LSTM captures temporal patterns in packet length sequences. To our knowledge, this is the first multimodal IDS capable of real-time online traffic processing. Experimental results demonstrate that RCML-IDS outperforms existing approaches on public and self-collected datasets. Its lightweight version achieves a per-sample processing time of approximately 20 milliseconds and permits deployment on resource-constrained devices, offering an effective solution for IoT security.