## 3 Methodology
### Self-Attention Mechanism
The ROC curves for each attack class--Blackhole, Flooding, Grayhole, Normal, and TDMA--exhibit the exceptional efficacy of the proposed Conv1D-GRU-Self-Attention model in multi-class intrusion detection. The graphic demonstrates that all class-specific ROC curves are tightly aligned with the top-left corner, signifying almost flawless true positive rates and little false positives. Every class attained an area under the curve (AUC) value of 1.00, validating the model's capacity to impeccably differentiate among distinct incursion types. This remarkable outcome underscores the efficacy of the hybrid deep

Figure 4: ROC curves for each class of attacks. Figure 3: Precision, recall, F1-score per class of attacks. learning architecture, together with balanced preprocessing methods like SMOTE and manual upsampling, in optimizing the model's discriminative capability. The optimal AUC values for all classes confirm the model's robustness, dependability, and suitability for implementation in real-world WSN situations. Figure 5 demonstrates that the proposed model effectively achieves both high predicted accuracy and realistic reaction time, establishing it as a viable solution for real-world WSN intrusion detection tasks. To validate the effectiveness of the proposed Conv1D-GRU-Self-Attention model, a comparative analysis was conducted against several established intrusion detection models, including GWO-LSTM [19] Long Short-Term Memory network optimized using the Grey Wolf Optimizer for sequence modeling, DNN [8] with multiple dense layers for general classification tasks, COA-GS-IDNN [14], an IDNN enhanced with Coyote Optimization Algorithm and Global Search for parameter tuning, and AdaBoost-RBFSVM [22] Ensemble learning via AdaBoost combined with Radial Basis Function kernel-based SVM. The comparison was based on five key evaluation metrics: accuracy, F1-score, precision, recall, and ROC-AUC. Performance comparison of the proposed model with baseline 569 methods is illustrated in Table 6.

#### Cooperative Node-Based Detection Simulation

To simulate distributed intrusion detection, the balanced dataset was partitioned randomly into five distinct subsets, each representing data from a separate WSN node. The hybrid deep learning model (Conv1D-GRU-Self-Attention) was trained independently on each partition to evaluate its adaptability and generalization across varying data sources. The detection accuracy across five independently trained nodes is listed in Table 7.

The average accuracy across all five nodes was 97.12%, with only minor variations between nodes. These results indicate strong consistency and generalizability of the proposed model across decentralized data sources. It also demonstrates the model's potential for real-world deployment in a cooperative intrusion detection framework, where \begin{table}
\begin{tabular}{c c c c c c} \hline \hline
**Metric** & **Conv1D-GRU-Self Attention** & **GWO-LSTM** & **DNN** & **COA-GS-IDNN** & **AdaBoost-RBFSVM** \\ \hline Accuracy & 98.60\% & 91\% & 93\% & 95\% & 92\% \\ \hline F1-score & 98.60\% & 90\% & 92\% & 95\% & 92\% \\ \hline Precision & 98.63\% & 89\% & 91\% & 94\% & 90\% \\ \hline Recall & 98.60\% & 92\% & 94\% & 96\% & 92\% \\ \hline ROC-AUC & 99.94\% & 94\% & 96\% & 98\% & 95\% \\ \hline \hline \end{tabular}
\end{table} 
Table 6: Result analysis. Figure 5: Evaluation metrics. individual sensor nodes analyze localized traffic and share their predictions with a central aggregator for final decision-making. ## 7 Discussion

Compared to existing intrusion detection models, the proposed Conv1D-GRU-Self Attention architecture demonstrates superior performance across key metrics. For instance, it outperforms models such as GWO-LSTM and COA-GS-IDNN, which have shown moderate accuracy improvements but lack attention mechanisms that enhance feature prioritization. Furthermore, models like AdaBoost-RBFSVM and traditional DNNs achieve lower precision and recall, especially under class imbalance conditions.