The Global and Local Temporal (GLT) NID model, which utilizes the self-attention mechanism of the Transformer to extract global dependencies and complex feature correlations from network traffic sequences while combining the bidirectional recurrent structure of BiLSTM to capture local temporal features of traffic data.
Abstract
Network Intrusion Detection (NID) is essential for cybersecurity because network traffic and security threats are growing rapidly. However, current NID methods suffer from a critical limitation: they face inherent difficulties in jointly modeling global contextual dependencies and local fine-grained temporal features within network traffic, which leads to suboptimal detection accuracy. To address this, this paper proposes the Global and Local Temporal (GLT) NID model. This model utilizes the self-attention mechanism of the Transformer to extract global dependencies and complex feature correlations from network traffic sequences while combining the bidirectional recurrent structure of BiLSTM to capture local temporal features of traffic data. Additionally, to address the class imbalance issue in intrusion detection datasets, this paper introduces a power-smoothed soft weighting strategy for optimization. We tested the GLT model on the NSL-KDD and UNSW-NB15 datasets. On the NSL-KDD dataset, the model achieved 99.57% accuracy and 0.32% false positive rate. On the UNSW-NB15 dataset, it achieved 88.04% accuracy and 0.76% false positive rate. Compared to current state-of-the-art techniques, it demonstrates higher detection accuracy and lower false positive rates.
Experimental results demonstrate that the proposed model achieves high detection accuracy, strong discriminative capability, and low false alarm rates across both datasets, confirming its effectiveness and scalability for next-generation cybersecurity applications.
The rapid expansion of the Internet of Things (IoT) has transformed modern industrial communication. However, this massive growth has introduced critical security vulnerabilities into network environments. Current intrusion detection systems struggle to address these threats effectively due to high false alarm rates. To overcome these challenges, this study introduces the Multi-Granularity Attention-based Graph Attention Network Bidirectional Long Short-Term Memory (MGA-GBiLSTM) framework for accurate multi-class traffic categorisation. The proposed MGA-GBiLSTM functions by mapping network connections into dynamic graphs and utilises a gated attention mechanism to cross-verify individual anomalies against peer-group and organisational baselines. By combining Graph Attention Networks for spatial mapping with a BiLSTM for deep temporal analysis, the system simultaneously validates the structural intent and sequential patterns of network actions. The MGA-GBiLSTM model was evaluated using the CIC IoT-DIAD 2024, CICDDoS2019, and UNSW-NB15 datasets. Experimental results demonstrate that the framework achieves impressive classification accuracy of 99.16% on the CIC IoT-DIAD 2024 dataset, 99.78% on the CICDDoS2019 dataset and 98.91% on the UNSWNB-15 dataset, respectively. Ultimately, this MGA-GBiLSTM approach improves system reliability in automated monitoring by significantly reducing alert fatigue while maintaining a robust defence against complex cyber threats.
B. K. Reddy, Prasath Nithiyanandam, M. Veeresha· 2026 5th International Confe...· 0 citations
As MNI becomes increasingly vulnerable to new kinds of attacks from the cyber world, accurate and timely detection of intrusions becomes a primary key to the power of cybersecurity. More complex attack patterns, complex traffic interactions within large scales are not very collaborable with the typical signature-based detection methods. A Transformer Based Network Anomaly Detection System for intelligent cyber security monitoring based on network flow analysis (NFAs) is proposed in the paper. This framework is derived from the CICIDS2017 data-set and proposes 78 of the statistical flow characteristics, where each flow characteristic impacts the behaviour of a packet, protocol, volume of traffic and temporal communication pattern. The model uses a Transformer Encoder network architecture along with multiple heads of self-attention, which provides greater understanding to deal with complex relationships between features from network traffic. LabelEncoder and StandardScaler have been applied to the columns with values that need to be encoded for categorical variables and scaled to fit the values for models training. A trained model is then applied to progress multiple different categories of cyberattacks including DDoS attacks, PortScan, Brute Force, Botnet, Web Based, etc. and different kinds of traffic, all traffic is considered benign traffic. For providing real-time predictions, confidence interval, prediction of class severity and alerts using trained model an API developed on flask to connect the trained model to a dashboard was built. The experimental results show that the Transformer-based learning could be very effective in achieving successful capturing of the network behavior and conducting realistic detection. The overall proposed system offers an intelligent, scalable and deployment-centric approach to improve the monitoring and proactive detection of threats in contemporary networks in the field of cybersecurity.
S. Nagendrudu, Shaik Mohammed Anays, F. Mahammad et al.· 2026 International Conferenc...· 0 citations
Intrusion detection is essential in contemporary manufacturing systems. These are vulnerable to various cyber threats due to the integration of cyber-physical systems and continuous data exchange. Traditional intrusion detection systems include statistical models and standard machine learning (ML) approaches. They struggle with high-dimensional sensor data, imbalanced datasets, and fast-changing attack patterns. To overcome these challenges, we propose a hybrid intrusion detection model. It combines Dynamic Feature Convolution (DFC) with a Transformer-based temporal modelling structure. The DFC component uses gated convolutional layers with sigmoid and tanh activations to learn localized temporal features. The Transformer component applies self-attention mechanisms to capture long-term dependencies. This hybrid model learns both local feature dynamics and global temporal dependencies in industrial time series data. We evaluated the proposed model using the publicly available Water Distribution (WADI) dataset. This dataset simulates realistic industrial processes under both normal and attack scenarios. Experimental results demonstrate robust detection performance. Over five independent training runs and 5-fold cross-validation, the model achieved an average accuracy of 97.34% ± 0.23. It also reached a precision of 97.47% ± 0.24, a recall of 97.14% ± 0.22, and an F1-score of 97.30% ± 0.23. The close values of precision and recall, further supported by confusion matrix analysis and low variance across folds, indicate balanced class learning rather than precision inflation. These results demonstrate robust and repeatable intrusion detection performance rather than isolated success. Our findings suggest that the proposed hybrid framework offers a robust and efficient solution for real-time intrusion detection in manufacturing systems.
P. Premkrishnan, G. Lawrance, P. Sam Paul et al.· Discover Mechanical Engineer...· 0 citations
Accurately and in real-time identifying advanced cyber-attacks continues to be a serious challenge for modern Network Intrusion Detection Systems (NIDS), especially in situations of highly imbalanced network traffic load and large-scale network attacks. Signature-based and single-model learning methods are typically ineffecive in capturing the complexity of traffic interactions and are not generalizable to new attack patterns. To overcome these limitations, this study introduces an Enhanced Multi-Model Ensemble Network Intrusion Detection System (EME-NIDS), a deep meta-learning system that combines five different heterogeneous learning paradigms, including Convolutional Neural Networks (CNN), Dense Neural Networks, Transformers, XGBoost, and Random Forests. The probabilistic output of the base learners is then condensed into a 220-dimensional meta-feature space and further processed by a five-layer deep meta-learner with approximately 289 k trainable parameters. A large-scale network flow dataset with 703,168 instances was used to assess the learning stability and attack detection of the minority class in the presence of various attacks, with 43 attacks and one attack class (benign) in the dataset. The experimental evaluation provided a detection accuracy of 95.65% and a macro-ROC-AUC score of 99.76%, outperforming all standalone models. Moreover, the proposed framework, which provides an average inference latency of 8.4 ms is suitable for real-time intrusion detection. The robustness, scalability and practical deployment capability of the proposed EME-NIDS framework were confirmed by statistical significance analysis (McNemar’s test, p < 0.001) and ablation studies.
The rapid growth of networked and cloud-connected infrastructure has widened the attack surface available to
adversaries, exposing enterprise and IoT environments to increasingly stealthy and evolving intrusions. Signature-based
and shallow machine-learning intrusion detection systems (IDS) generalize poorly to zero-day and low-frequency attack
classes and typically treat traffic features independently, ignoring both the spatial correlation among flow attributes and the
temporal evolution of a connection. This paper proposes a novel Hybrid CNN-BiLSTM Attention-based Ensemble
Framework (CBAF) that unifies three complementary representations of network traffic. A one-dimensional feature vector
is first reshaped into a two-dimensional matrix and passed through convolutional layers that learn local spatial correlations
among protocol, packet, and byte-level attributes. The resulting feature maps are fed into a Bidirectional Long Short-Term
Memory (BiLSTM) network that models the forward and backward temporal dependencies characteristic of multi-stage
attacks. A self-attention layer then assigns adaptive importance weights to the most discriminative time steps and features,
improving both detection accuracy and interpretability. The attention-weighted representation is finally passed to a stacked
Random Forest meta-classifier that consolidates the deep and shallow decision boundaries to reduce false positives. The
framework further incorporates SMOTE-based oversampling to counter the severe class imbalance found in benchmark
intrusion datasets. Experiments on NSL-KDD, CICIDS2017, and UNSW-NB15 show that the proposed CBAF achieves
97.6% accuracy and a 0.96 F1-score, outperforming Logistic Regression, Support Vector Machine, Random Forest, and a
plain CNN-LSTM baseline, while maintaining real-time inference latency suitable for deployment in security operations
centers (SOCs).
Vishwaradhya K., Annappa S. S., L. C.· International Journal of Inn...· 0 citations