Experimental results demonstrate that the proposed model achieves high detection accuracy, strong discriminative capability, and low false alarm rates across both datasets, confirming its effectiveness and scalability for next-generation cybersecurity applications.
Abstract
Intrusion detection systems (IDSs) play a vital role in safeguarding modern computer networks against increasingly sophisticated and high-volume cyber threats. Recent progress in artificial intelligence, especially deep learning, has allowed IDSs to go from static rule-based systems to adaptive and data-driven security solutions. But traditional machine learning- and convolution-based IDSs often have trouble finding long-range dependencies and temporal correlations in large-scale network traffic. This makes detection less accurate and increases the number of false alarms. This challenge becomes more pronounced in heterogeneous and evolving network environments. To address this, experiments are conducted on two widely used benchmark datasets: CIC-IDS2017 for binary intrusion detection and CICIDS2018 for multiclass attack classification. These datasets represent realistic network traffic with diverse attack categories and severe class imbalance. The proposed methodology employs a Transformer-based intrusion detection framework incorporating sequence windowing, positional encoding, and multi-head self-attention to learn contextual traffic representations. The primary contribution of this study lies in systematically integrating sliding temporal windowing, positional encoding, and multi-head self-attention into flow-level intrusion modeling, accompanied by empirical ablation analysis and statistical validation across two large-scale CIC benchmark datasets. Performance is evaluated using accuracy, precision, recall, F1-score, ROC-AUC, and false alarm rate. Experimental results demonstrate that the proposed model achieves high detection accuracy, strong discriminative capability, and low false alarm rates across both datasets, confirming its effectiveness and scalability for next-generation cybersecurity applications.
The findings confirm that the proposed IDSaaS framework provides an efficient, scalable, and adaptive solution for real-time cloud intrusion detection and significantly enhances the reliability and resilience of modern cloud and industrial cybersecurity infrastructures.
Unik B. Lokhande, Kavita Sonawane· Journal of Cloud Computing· 0 citations
Traditional rule-based intrusion detection systems generally fail in identifying unknown or evolving threats; thus, automated and adaptive kinds of methods are crucial. Deep learning models provide promising solutions, but many recent studies depend on hybrid architecture, which increase the computational cost and reduce deploying ability on real-time or resource-limited systems. In this paper, we present and test a standalone LSTM model for multiclass cyberattack detection based on a CIC_IoT_Dataset2023, a recent labeled dataset that mirrors the actual network environment containing 33 attack categories. The dataset was extremely imbalanced as benign traffic accounted for most of the classes. To detect such attacks, we used the Synthetic Minority Oversampling Technique (SMOTE) to increase the frequency of less common types of address. The pre-processed dataset was then employed to train four models (RNN, CNN, DNN and the proposed LSTM) for performance analysis with sequential data. The proposed LSTM model achieved an accuracy between 2% and 7%. LSTM had good detection for frequent attacks and slow-changing patterns, which shows its capacity in learning long-lasting dependencies. The results demonstrate that a simple, lightweight standalone LSTM model can be used for effective and realistic intrusion detection without the need for complex hybrid architecture.
Jawad Hussain Awan, Misbah Safdar, Muhammad Ayaz Shirazi et al.· Italian National Conference...· 0 citations
A two-tier hybrid IDS that uses a Random Forest model for quick initial detection and a Neural Network for deeper analysis of suspicious traffic is proposed that provides a balanced and efficient solution that overcomes key limitations of existing IDS models and offers a pathway towards a more robust real-time IoT intrusion detection.
R. Paper, Wong Zoey, Y. Watanabe et al.· International Journal of Eme...· 0 citations
IDS is a crucial element in defending against dynamic, emerging cyberattacks on modern network infrastructure. The current deep learning intrusion detection systems, however, suffer from three primary drawbacks: a lack of modeling temporal traffic dependencies, an inability to effectively handle class imbalance, and low interpretability for security analysts. To address these problems, this paper presents an explainable BiLSTM-Attention intrusion detection framework that leverages SMOTE-ENN-based adaptive imbalance handling for IDS2018 traffic. The proposed framework combines Chi-Square-based feature selection, Lasso-based feature selection, SMOTE-ENN-based class balancing, and BiLSTM-based bidirectional temporal learning with the attention mechanism highlighting informative traffic patterns. There is also a feature-level interpretation stage to increase the transparency of intrusion decisions. The model was tested on a processed dataset of IDS2018 samples, comprising 7,517 samples and 78 features for traffic classification in a binary intrusion detection scenario. The accuracy, precision, recall, F1-score, MCC, and false alarm rate of the proposed BiLSTM-Attention + SMOTE-ENN framework are 94.41%, 80.26%, 99.20%, 88.73%, 0.8592, and 6.95%, respectively, according to experimental results. Additionally, the model's inference latency was 0.0339 ms per sample, suggesting it is suitable for near-real-time intrusion detection. The results validate the effectiveness of attention-based recurrent IDS models on sampled IDS2018 traffic through adaptive imbalance handling.
B. Kiranmayee, Dr. J.Krishna, Research Supervisor· 2026 6th International Confe...· 0 citations
As MNI becomes increasingly vulnerable to new kinds of attacks from the cyber world, accurate and timely detection of intrusions becomes a primary key to the power of cybersecurity. More complex attack patterns, complex traffic interactions within large scales are not very collaborable with the typical signature-based detection methods. A Transformer Based Network Anomaly Detection System for intelligent cyber security monitoring based on network flow analysis (NFAs) is proposed in the paper. This framework is derived from the CICIDS2017 data-set and proposes 78 of the statistical flow characteristics, where each flow characteristic impacts the behaviour of a packet, protocol, volume of traffic and temporal communication pattern. The model uses a Transformer Encoder network architecture along with multiple heads of self-attention, which provides greater understanding to deal with complex relationships between features from network traffic. LabelEncoder and StandardScaler have been applied to the columns with values that need to be encoded for categorical variables and scaled to fit the values for models training. A trained model is then applied to progress multiple different categories of cyberattacks including DDoS attacks, PortScan, Brute Force, Botnet, Web Based, etc. and different kinds of traffic, all traffic is considered benign traffic. For providing real-time predictions, confidence interval, prediction of class severity and alerts using trained model an API developed on flask to connect the trained model to a dashboard was built. The experimental results show that the Transformer-based learning could be very effective in achieving successful capturing of the network behavior and conducting realistic detection. The overall proposed system offers an intelligent, scalable and deployment-centric approach to improve the monitoring and proactive detection of threats in contemporary networks in the field of cybersecurity.
S. Nagendrudu, Shaik Mohammed Anays, F. Mahammad et al.· 2026 International Conferenc...· 0 citations
