From Signature to Attention: Transformer-Powered Intrusion Detection Systems for Cybersecurity

Adaptive intrusion detection system for cloud security using deep learning

Cloud computing environments are increasingly vulnerable to sophisticated cyber threats due to the rapid growth of cloud-native infrastructures, high-volume network traffic, and evolving attack strategies such as zero-day exploits, adversarial attacks, and polymorphic malware. Traditional intrusion detection systems often struggle to maintain high detection accuracy, scalability, adversarial robustness, and real-time processing capability in dynamic cloud environments. To address these challenges, this study proposes an adaptive Intrusion Detection System-as-a-Service (IDSaaS) framework using a Modified Attention-Gate based BiLSTM-GRU architecture integrated with GAN-assisted synthetic anomaly generation. The proposed framework combines Bidirectional Long Short-Term Memory networks for temporal dependency learning, Gated Recurrent Units for computational efficiency, a custom attention mechanism for dynamic feature prioritization, a modified recurring gate structure for optimized information retention, and a Revamping Input Sequence Weighing Structure (RISWS) loss function for improved anomaly classification performance. Experiments were conducted using the CICIDS-2018, UNSW-NB15, SCAPY-based, and SCADANet datasets within an AWS cloud deployment environment. The proposed model achieved strong intrusion detection performance with 97.91% multi-class detection accuracy, 98.67% precision, 97.93% recall, and 98.18% F1-score while maintaining low inference latency and high throughput suitable for real-time deployment. Additional evaluation on the SCADANet industrial cybersecurity dataset achieved 99.69% test accuracy, further validating the adaptability of the framework across heterogeneous cloud and industrial network environments. Throughput analysis demonstrated stable processing capability of approximately 48,000 packets per second and 12,500 flows per second under high traffic conditions. The findings confirm that the proposed IDSaaS framework provides an efficient, scalable, and adaptive solution for real-time cloud intrusion detection and significantly enhances the reliability and resilience of modern cloud and industrial cybersecurity infrastructures.

AI-Driven Security: Detecting Cyber Attacks in IoT Networks

Traditional rule-based intrusion detection systems generally fail in identifying unknown or evolving threats; thus, automated and adaptive kinds of methods are crucial. Deep learning models provide promising solutions, but many recent studies depend on hybrid architecture, which increase the computational cost and reduce deploying ability on real-time or resource-limited systems. In this paper, we present and test a standalone LSTM model for multiclass cyberattack detection based on a CIC_IoT_Dataset2023, a recent labeled dataset that mirrors the actual network environment containing 33 attack categories. The dataset was extremely imbalanced as benign traffic accounted for most of the classes. To detect such attacks, we used the Synthetic Minority Oversampling Technique (SMOTE) to increase the frequency of less common types of address. The pre-processed dataset was then employed to train four models (RNN, CNN, DNN and the proposed LSTM) for performance analysis with sequential data. The proposed LSTM model achieved an accuracy between 2% and 7%. LSTM had good detection for frequent attacks and slow-changing patterns, which shows its capacity in learning long-lasting dependencies. The results demonstrate that a simple, lightweight standalone LSTM model can be used for effective and realistic intrusion detection without the need for complex hybrid architecture.

A Two-Tier Hybrid Intrusion Detection System for IoT Networks

The rapid growth of Internet of Things (IoT) devices has made modern attacks more vulnerable to cyberattacks. Traditional signature-based Intrusion Detection Systems (IDS) are no longer enough to keep up with new and evolving threats. Although machine learning and deep learning have improved detection accuracy, many AI-driven IDS models still face major issues. They often struggle to detect zero-day attacks, produce high false-positive rates and perform poorly with imbalanced datasets. Some models are also too computationally heavy to run efficiently in real time. To address these weaknesses, this research proposes a two-tier hybrid IDS that uses a Random Forest model for quick initial detection and a Neural Network for deeper analysis of suspicious traffic. A confidence threshold of 0.8 is used to decide whether traffic should be accepted or sent for further inspection. Using the NSL-KDD dataset, the system includes preprocessing steps such as binary mapping and structured feature extraction to support both detection stages. Our comparative analysis shows that this hybrid approach can achieve better accuracy, fewer false alarms, and stronger detection of unknown attacks compared to existing Machine Learning / Deep Learning IDS methods. It is more practical for large, diverse IoT environments because it reduces computational load while maintaining strong detection capability. Overall, the proposed architecture provides a balanced and efficient solution that overcomes key limitations of existing IDS models and offers a pathway towards a more robust real-time IoT intrusion detection.

Explainable BiLSTM-Attention based Intrusion Detection with Adaptive Imbalance Handling

IDS is a crucial element in defending against dynamic, emerging cyberattacks on modern network infrastructure. The current deep learning intrusion detection systems, however, suffer from three primary drawbacks: a lack of modeling temporal traffic dependencies, an inability to effectively handle class imbalance, and low interpretability for security analysts. To address these problems, this paper presents an explainable BiLSTM-Attention intrusion detection framework that leverages SMOTE-ENN-based adaptive imbalance handling for IDS2018 traffic. The proposed framework combines Chi-Square-based feature selection, Lasso-based feature selection, SMOTE-ENN-based class balancing, and BiLSTM-based bidirectional temporal learning with the attention mechanism highlighting informative traffic patterns. There is also a feature-level interpretation stage to increase the transparency of intrusion decisions. The model was tested on a processed dataset of IDS2018 samples, comprising 7,517 samples and 78 features for traffic classification in a binary intrusion detection scenario. The accuracy, precision, recall, F1-score, MCC, and false alarm rate of the proposed BiLSTM-Attention + SMOTE-ENN framework are 94.41%, 80.26%, 99.20%, 88.73%, 0.8592, and 6.95%, respectively, according to experimental results. Additionally, the model's inference latency was 0.0339 ms per sample, suggesting it is suitable for near-real-time intrusion detection. The results validate the effectiveness of attention-based recurrent IDS models on sampled IDS2018 traffic through adaptive imbalance handling.

Transformer-based Network Anomaly Detection System for Intelligent Cyber Security Monitoring

As MNI becomes increasingly vulnerable to new kinds of attacks from the cyber world, accurate and timely detection of intrusions becomes a primary key to the power of cybersecurity. More complex attack patterns, complex traffic interactions within large scales are not very collaborable with the typical signature-based detection methods. A Transformer Based Network Anomaly Detection System for intelligent cyber security monitoring based on network flow analysis (NFAs) is proposed in the paper. This framework is derived from the CICIDS2017 data-set and proposes 78 of the statistical flow characteristics, where each flow characteristic impacts the behaviour of a packet, protocol, volume of traffic and temporal communication pattern. The model uses a Transformer Encoder network architecture along with multiple heads of self-attention, which provides greater understanding to deal with complex relationships between features from network traffic. LabelEncoder and StandardScaler have been applied to the columns with values that need to be encoded for categorical variables and scaled to fit the values for models training. A trained model is then applied to progress multiple different categories of cyberattacks including DDoS attacks, PortScan, Brute Force, Botnet, Web Based, etc. and different kinds of traffic, all traffic is considered benign traffic. For providing real-time predictions, confidence interval, prediction of class severity and alerts using trained model an API developed on flask to connect the trained model to a dashboard was built. The experimental results show that the Transformer-based learning could be very effective in achieving successful capturing of the network behavior and conducting realistic detection. The overall proposed system offers an intelligent, scalable and deployment-centric approach to improve the monitoring and proactive detection of threats in contemporary networks in the field of cybersecurity.

Artificial Intelligence based Intrusion Detection System