Attention-based intrusion detection using transformer networks on UNSW-NB15
6 affiliations
- 1Department of Computer Science, University of Benin
- 2College of Business, Westcliff University
- 3College of Business, Engineering and Technology, National University
- 4Department Computer Science, Veritas University
- 5Department of Data Science, University of Benin
- 6Department of Computer and Information Science, University of the Cumberlands
Abstract
The increasing complexity and volume of network traffic in modern digital infrastructures have rendered traditional rule-based intrusion detection systems insufficient for identifying sophisticated and evolving cyber threats. This study proposes an attention-based intrusion detection framework leveraging Transformer networks to model complex dependencies within network traffic data. Using the UNSW-NB15 dataset, a widely recognized benchmark for network intrusion detection, the proposed model captures both local and global feature interactions through self-attention mechanisms, enabling effective discrimination between normal and malicious activities. The experimental setup focuses on a supervised learning paradigm, where network traffic is preprocessed, encoded, and evaluated under a clearly defined classification task. The Transformer model achieved an accuracy of 96.8%, with strong performance across precision, recall, F1-score, and AUC-ROC metrics, demonstrating its robustness in handling high-dimensional and heterogeneous cybersecurity data. To ensure methodological rigor and reproducibility, the study employs a transparent data preprocessing pipeline, strict train-test separation, and detailed reporting of model configuration and evaluation procedures. Unlike prior works that rely heavily on convolutional or recurrent architectures, this research highlights the effectiveness of attention-based models for scalable and context-aware intrusion detection. While the current work focuses on detection, it outlines a conceptual pathway for integrating decision-making mechanisms to support adaptive and automated response in future systems. The findings contribute to the advancement of intelligent cybersecurity by demonstrating that Transformer-based architectures can provide reliable and generalizable performance for real-world intrusion detection tasks.
Related
- An energy-aware and lightweight spiking neural network framework for real-time intrusion detection in IoT networks
- Asymmetric class-conditional routing in a federated quantum mixture-of-experts improves imbalanced intrusion detection in edge industrial IoT networks
- HIFN-Mamba: hybrid information flow networks with selective state-space sequence modeling for intrusion detection in the Internet of Medical Things
- AVMD-ST: attention-variational mode decomposition based spectrogram transformer for differential diagnosis of asthma and COPD
- Interpretable attention-deficit hyperactivity disorder diagnosis from functional magnetic resonance imaging via hybrid convolutional neural network–transformer learning and multi-level graph-based comprehensibility
BibTeX
@article{oise2026attentionbased,
title = {{Attention-based intrusion detection using transformer networks on UNSW-NB15}},
author = {Godfrey Perfectson Oise and Evans Mintah and Oludare Sokoya and Felix Oshiorenoya Uloko and Tejiri Jessa and Susan Konyeha and Osahon Ukpebor},
journal = {Scientific Reports},
year = {2026},
month = aug,
doi = {10.1038/s41598-026-65710-2},
url = {https://doi.org/10.1038/s41598-026-65710-2},
note = {CC BY},
}
RIS
TY - JOUR
TI - Attention-based intrusion detection using transformer networks on UNSW-NB15
AU - Godfrey Perfectson Oise
AU - Evans Mintah
AU - Oludare Sokoya
AU - Felix Oshiorenoya Uloko
AU - Tejiri Jessa
AU - Susan Konyeha
AU - Osahon Ukpebor
PY - 2026
DA - 2026/08/01
JO - Scientific Reports
DO - 10.1038/s41598-026-65710-2
UR - https://doi.org/10.1038/s41598-026-65710-2
AB - The increasing complexity and volume of network traffic in modern digital infrastructures have rendered traditional rule-based intrusion detection systems insufficient for identifying sophisticated and evolving cyber threats. This study proposes an attention-based intrusion detection framework leveraging Transformer networks to model complex dependencies within network traffic data. Using the UNSW-NB15 dataset, a widely recognized benchmark for network intrusion detection, the proposed model captures both local and global feature interactions through self-attention mechanisms, enabling effective discrimination between normal and malicious activities. The experimental setup focuses on a supervised learning paradigm, where network traffic is preprocessed, encoded, and evaluated under a clearly defined classification task. The Transformer model achieved an accuracy of 96.8%, with strong performance across precision, recall, F1-score, and AUC-ROC metrics, demonstrating its robustness in handling high-dimensional and heterogeneous cybersecurity data. To ensure methodological rigor and reproducibility, the study employs a transparent data preprocessing pipeline, strict train-test separation, and detailed reporting of model configuration and evaluation procedures. Unlike prior works that rely heavily on convolutional or recurrent architectures, this research highlights the effectiveness of attention-based models for scalable and context-aware intrusion detection. While the current work focuses on detection, it outlines a conceptual pathway for integrating decision-making mechanisms to support adaptive and automated response in future systems. The findings contribute to the advancement of intelligent cybersecurity by demonstrating that Transformer-based architectures can provide reliable and generalizable performance for real-world intrusion detection tasks.
SN - 2045-2322
ER -