A Hybrid Autoencoder and Transformer-Based Framework for Intrusion Detection in IoT Networks

Abstract

: Intrusion detection in Internet-of-Things (IoT) and enterprise networks must combine high predictive performance with reliable minority-attack recognition, leakage-safe evaluation, and deployable computational cost. This study presents an Optimized Gated Autoencoder-Transformer that preserves standardized raw flow descriptors, supplements them with frozen autoencoder-derived latent embeddings, and learns a sample-specific gate before lightweight Transformer feature attention. The framework is evaluated on the binary BoTNeTIoT-L01 benchmark and a seven-group CICIDS2017 setting using a split-first protocol, five random seeds, strong tree and neural baselines, component ablations, per-class metrics, and latency measurements. The optimized model achieves 99.99 ± 0.01% macro-F1 on BoTNeTIoT-L01 and 99.64 ± 0.05% on CICIDS2017-7group. On CICIDS2017, all seven groups retain F1 scores above 99.30%, including Bot/Infiltration and Web Attack, while inference remains 0.132 ± 0.009 ms per sample. The