# Explainable Lightweight Block Attention Module Framework for Network-Based IoT Attack Detection
## 1 Introduction  
Computer network systems have been implemented to enable device communication and perform crucial business functions. However, this creates a higher reliance on an entity's connection systems' primary functions. Due to their extensive and critical reliance on computer networks, key sectors including banking, healthcare organizations, and service providers are subject to instability threats [1; 2; 3; 4]. Due to this dependence, maintaining ideal networks is necessary to maintain accessibility, efficiency, and safety. A security breach can significantly impact network performance, leading to instability and eventual network incompatibility. Moreover, cyberattacks may result in blackouts, issues in weapon systems, and confidential information releases. They might cause the loss of priceless sensitive data, such as hospital files, military records, etc. Furthermore, they can disable phone and computernetworks, making data unavailable or rendering systems unusable [5; 6; 7]. Banking and government networks are particularly vulnerable because of the tremendous value of the data they contain. The hackers steal the information (especially other people's banking details) and profit from that information. Over the past decade, there have been instances of different kinds of hybrid network attacks, causing severe system anomalies. Such attacks have been more prevalent over the past ten years, posing a severe threat to the stability of networks due to the modification of numerous services [8; 9; 10]. Denial of service (DoS) attacks fall into mainly two categories: service outages and service flooding. The internet-of-things network has experienced severe losses due to DDoS attacks. Therefore, IoT users consequently have paid great attention to the vulnerabilities. Numerous devices or systems work together to attack a single target, making it challenging to locate and disable the attacking devices [11; 12; 13; 14; 15]. Cyberattackers frequently use a botnet to interfere with internet infrastructure. DDoS attacks are difficult to identify and prevent in real time, yet this approach has enormous utility because attacks can have significant effects. Many intrusion detection systems (IDSs) have been developed in the past to identify these assaults, utilizing a variety of techniques involving mathematical modeling, and data mining techniques such as machine learning techniques, etc. Due to their difficulties in processing high-dimensional network information, these analytical and conventional machine learning models perform poorly [16; 17; 18; 19; 20]. Therefore, deep learning-based techniques are essential to handle these issues. Recently, deep learning has attracted much interest in attack detection due to its efficient feature extraction and learning abilities, specifically in settings with massive datasets. Without contextual information, deep learning techniques eventually capture significant characteristics from the input data using numerous layers [21; 22; 23; 24]. Therefore, in this paper, Densenet-based deep learning was implemented to perform multi-class classification on DoS and DDoS attacks. To solve the imbalanced data issue, a self-organized generative adversarial network (SOMGAN) was implemented to perform data augmentation. Afterwards, the feature extraction and selection are performed using a pyramid atrous attention network and artificial bee colony optimization algorithm (ABC). Finally, the attacks were detected and classified using a convolution block attention classifier.