An Attention-based Transformer Encoder for Efficient Intrusion Detection in High-Volume Network Traffic

Abstract

The rapid growth in cloud computing and the emergence of the new Internet of Things (IoT) environment, there has also been a corresponding increase in long-term and high-volume network traffic and ever-growing complexity of cyber-attacks. This growth creates a significant challenge in achieving accurate and timely intrusion detection. Traditional Intrusion Detection Systems (IDS) and Long Short-Term Memory (LSTM) models are detecting malicious activity with limited scalability; process information sequentially, causing increased overhead; and inefficiently model long time-frame dependencies (i.e., long-term detection). Given this need for scalable and low-latency IDS with the ability to detect complex and zero-day attacks, this research work provides an Attention Based (self-attention-based) intrusion detection system (AB-IDS). The proposed AB-IDS uses transformer encoders based on self-attention rather than recurrent models. It models network traffic as time-sequenced flows and uses a multi-head self-attention mechanism to capture all long-term dependencies in parallel. Results from extensive evaluations using the CIC-IDS 2017, UNSW-NB15, and NSL-KDD benchmark datasets show that the AB-IDS consistently offers performance improvements of up to 2.6% (increased accuracy) and up to 46.2% reduction (in reduced false alarm rates) over BiLSTM Based IDS. In addition, the proposed method reduces the amount of time required to train the network by 44.6% and the amount of time needed to make the inferences from the network by 52.9%. Based on these findings, the proposed approach has demonstrated its capability to be effectively used for real-time intrusion detection in large Cloud Computing (CC) and IoT networks.