NetBERT: Transformer-Driven Robust Intrusion Detection Across Multi-Domain Network Traffic

Abstract

Encrypted communication protocols are increasingly being leveraged to evade traditional Intrusion Detection Systems (IDS), particularly through techniques such as DNS tunneling and DNS over HTTPS (DoH).However, the existing frameworks primarily focused on non-encrypted attack traffic and are operated as a black-box model without interpretability or real-time evaluation.In this paper, we introduce NetBERT, a transformer-driven and explainable intrusion detection system capable of analyzing both conventional (non-encrypted) attacks and encrypted DNS-based attacks. In particular, the proposed extension incorporates detection of encrypted DNS tunneling, which is increasingly being used for covert command-and-control communication and data exfiltration.The NetBERT framework has been integrated with class imbalance mitigation using SMOTETomek, contextual traffic representation using BERT embeddings and classification using a multilayer perceptron (MLP). To enhance transparency, Local Interpre table Model-Agnostic Explanations (LIME) have been incorporated to provide interpretable insights into model predictions. Furthermore, a live packet capture and testing pipeline is introduced to evaluate the system on real-time network traffic.Experimental results demonstrate that NetBERT effectively detects both traditional and encrypted DNS-based attacks while maintaining strong classification performance demonstrating the effectiveness of the proposed extension for modern IDS deployments.