Intrusion detection based on the ManFormer model

Abstract

Network intrusion detection is a key component for ensuring cyberspace security and stable network operation. To address the limitations of traditional methods in high-dimensional network traffic, such as insufficient representation capability, degraded performance in classifying complex attacks, and limited generalization ability, this study designs and implements ManFormer, a hybrid Transformer–Mamba classification architecture that integrates Transformer and Mamba for high-dimensional imbalanced classification tasks. The proposed model uses a Transformer module to capture global interactions among PCA-derived latent feature tokens, and further introduces a Mamba state-space module to refine the dependencies within the context-enhanced latent feature sequence. This design improves, to some extent, the comprehensive recognition capability for complex attack categories and improves Macro-F1 to a certain extent. During data preprocessing, Borderline-SMOTE is applied to oversample minority-class samples in the training set, with a focus on difficult samples near class boundaries, thereby alleviating the class imbalance problem. In addition, CBLoss is adopted as the training loss function to dynamically adjust the weights of different classes and further compensate for differences in sample size. Experimental results show that ManFormer achieves good overall performance in high-dimensional imbalanced multi-class intrusion detection tasks. Although it improves Macro-F1 compared with standalone Transformer and Mamba models, the stable recognition of extremely rare attack classes remains challenging. Therefore, the proposed method should be regarded as an effective mitigation strategy for imbalanced intrusion detection, rather than a complete solution to extreme rare-class recognition.