Hybrid Transformer–CNN–BiLSTM Model with Mahalanobis Embedding for Zero-Day Intrusion Detection
A hybrid intrusion detection model that integrates a Feature Tokenization-based Transformer with a CNN–BiLSTM model to capture global feature interactions and local sequential dependencies in tabular network traffic data and indicates the strong zero-day detection capability with high family-wise true positive rates for Backdoor and Worms.