From Signature to Attention: Transformer-Powered Intrusion Detection Systems for Cybersecurity

Abstract

Intrusion detection systems (IDSs) play a vital role in safeguarding modern computer networks against increasingly sophisticated and high-volume cyber threats. Recent progress in artificial intelligence, especially deep learning, has allowed IDSs to go from static rule-based systems to adaptive and data-driven security solutions. But traditional machine learning- and convolution-based IDSs often have trouble finding long-range dependencies and temporal correlations in large-scale network traffic. This makes detection less accurate and increases the number of false alarms. This challenge becomes more pronounced in heterogeneous and evolving network environments. To address this, experiments are conducted on two widely used benchmark datasets: CIC-IDS2017 for binary intrusion detection and CICIDS2018 for multiclass attack classification. These datasets represent realistic network traffic with diverse attack categories and severe class imbalance. The proposed methodology employs a Transformer-based intrusion detection framework incorporating sequence windowing, positional encoding, and multi-head self-attention to learn contextual traffic representations. The primary contribution of this study lies in systematically integrating sliding temporal windowing, positional encoding, and multi-head self-attention into flow-level intrusion modeling, accompanied by empirical ablation analysis and statistical validation across two large-scale CIC benchmark datasets. Performance is evaluated using accuracy, precision, recall, F1-score, ROC-AUC, and false alarm rate. Experimental results demonstrate that the proposed model achieves high detection accuracy, strong discriminative capability, and low false alarm rates across both datasets, confirming its effectiveness and scalability for next-generation cybersecurity applications.