Network Intrusion Detection Based on Global-Local Temporal Feature Fusion Using Transformer and BiLSTM
TL;DR
The Global and Local Temporal (GLT) NID model, which utilizes the self-attention mechanism of the Transformer to extract global dependencies and complex feature correlations from network traffic sequences while combining the bidirectional recurrent structure of BiLSTM to capture local temporal features of traffic data.
Abstract
Network Intrusion Detection (NID) is essential for cybersecurity because network traffic and security threats are growing rapidly. However, current NID methods suffer from a critical limitation: they face inherent difficulties in jointly modeling global contextual dependencies and local fine-grained temporal features within network traffic, which leads to suboptimal detection accuracy. To address this, this paper proposes the Global and Local Temporal (GLT) NID model. This model utilizes the self-attention mechanism of the Transformer to extract global dependencies and complex feature correlations from network traffic sequences while combining the bidirectional recurrent structure of BiLSTM to capture local temporal features of traffic data. Additionally, to address the class imbalance issue in intrusion detection datasets, this paper introduces a power-smoothed soft weighting strategy for optimization. We tested the GLT model on the NSL-KDD and UNSW-NB15 datasets. On the NSL-KDD dataset, the model achieved 99.57% accuracy and 0.32% false positive rate. On the UNSW-NB15 dataset, it achieved 88.04% accuracy and 0.76% false positive rate. Compared to current state-of-the-art techniques, it demonstrates higher detection accuracy and lower false positive rates.