# Intrusion Detection in IoT Using Deep Residual Networks with Attention Mechanisms
## 5 Convolutional Block Attention Mechanism  
In the IoT environment, network traffic data often contains different features that are of different importance for intrusion detection. Therefore, this section introduces the CBAM module [30] in the model to help the model distinguish the importance of features in order to obtain important features and improve the performance of the model. As shown in Figure 3. The structures of the channel attention module and the spatial attention module are shown in Figures 4 and 5, respectively. The specific computational procedure of the CBAM module is described as follows: The specific structure of the channel attention module is shown in Figure 4. For a given feature map F, the channel attention module first performs Global Average Pooling (GAP) to obtain the average value of each channel, and then performs feature mapping through two fully connected layers to obtain the weight coefficients of each channel. Finally, the weight coefficients are applied to the feature map to emphasize the important channels and suppress the unimportant ones. The whole process is as follows:  
\[F^{\prime}=M_{\text{C}}(F)\otimes F. \tag{9}\]  
\[F^{\prime\prime}=M_{\text{C}}(F^{\prime})\otimes F^{\prime}. \tag{10}\]  
where \(\otimes\) denotes element-by-element multiplication. The channel attention module focuses on what is meaningful in the input data. CBAM has two pools: maximum pooling (MaxPool) and average pooling (AvgPool). Pooling allows extracting high-level features, and different pooling means extracting richer high-level features. Since each channel of the feature map extracts some level of feature information, the channel attention mechanism feature information is more important. In order to compute channel attention efficiently, the channel attention module uses a spatial dimensionality method that compresses the input feature mapping, compared to using a single pooling method the channel attention module uses average pooling and maximum pooling methods and proves that the dual pooling method has stronger representational power. The specific computational procedure is shown as follows:  
\[M_{C}(F)=\sigma(\text{MLP}(\text{AvgPool}(F))+\text{MLP}(\text{MaxPool}(F))). \tag{11}\]  
Figure 3: CBAM module diagram. The specific structure of the spatial attention module is shown in Figure 5. The feature maps processed by the channel attention module first pass through two convolution layers to obtain the weight coefficients of each pixel point. Here, the weight coefficients are calculated by considering the response of each pixel point on different spatial scales, and the similarity between pixel points. Finally, the weight coefficients are applied to the feature map to emphasize the important pixel points and suppress the unimportant ones. This improves the generalization ability of the model. The spatial attention module focuses on which location information is meaningful, and it also complements the channel attention module, as shown below:  
\[M_{\mathrm{C}}(F)=\sigma(\mathrm{Conv}[\mathrm{AvgPool}(F);\mathrm{MaxPool}]). \tag{12}\]  
where \(\sigma(\cdot)\) denotes the Sigmoid function, \(\mathrm{MaxPool}(\cdot)\) denotes the maximum pooling, \(\mathrm{AvgPool}(\cdot)\) denotes the average pooling, \(\mathrm{MLP}(\cdot)\) denotes the multilayer perceptron, and \(\mathrm{Conv}(\cdot)\) denotes the 3D convolutional layer. Finally, the model uses the Softmax layer to calculate the final traffic class using the output of the residual module and the CBAM module. The outputs of the residual and CBAM modules and the raw inputs are fed into the fully connected layer after manipulation. The fully connected layer then multiplies the weight matrix with the input vector and adds the bias as follows:  
\[z_{j}=w_{j}\cdot X+b_{j}=w_{j1}X_{1}+w_{j2}X_{2}+\cdots+w_{jn}X_{n}+b_{j}. \tag{13}\]  
where \(X\) is the input of the fully connected layer, \(w_{j}\) is the weight of the \(j\)-th class of features, and \(b_{j}\) is the bias term.