Adaptive active learning and metaheuristic-optimized transformer framework for robust intrusion detection in software-defined networks
Abstract
Existing intrusion detection systems largely rely on static supervised learning models that require extensive labeled data and periodic retraining. Such approaches struggle to adapt to evolving attack patterns in dynamic software-defined networks. To address these limitations, this study proposes an adaptive intrusion detection framework that integrates uncertainty-driven active learning, metaheuristic-based feature selection, Transformer-based attack classification, and adaptive hyperparameter optimization within a unified software-defined networking architecture. Unlike conventional adaptive intrusion detection systems that rely on static feature representations or fixed learning strategies, the proposed framework continuously refines both the training data and model configuration to improve robustness against evolving cyberattacks. The proposed framework iteratively identifies informative samples for annotation, optimizes feature subsets using adaptive search, and continuously updates the classifier to maintain high detection performance under changing traffic distributions. The proposed system was evaluated using the ToN-IoT dataset and additional real-world traffic traces. Experimental evaluation on benchmark and real-world network traffic datasets demonstrated a detection accuracy of up to 97.92% and an F1-score of 97.10%. Although the optimization stage increases offline training time, the optimized model maintains efficient inference during deployment, making it suitable for practical software-defined network environments. Performance was evaluated over five independent runs using different random initialization seeds. Although the optimization and active-learning stages increase offline training time, the optimized model maintains efficient inference during deployment. Performance was evaluated over five independent runs using different random initialization seeds. The results demonstrate that the complementary use of adaptive sample acquisition, feature selection, and hyperparameter optimization provides an effective intrusion-detection framework for software-defined network environments.
Related
- Fed-SecureCvT: optimized federated learning with cryptographic protection and transformer-based intrusion detection for HER
- A generative adversarial network-augmented dual-stream Mamba-transformer framework for advanced intrusion detection and cyber threat mitigation in smart healthcare networks
- An EfficientNet hybrid deep learning detection framework of network intrusion with an optimized mixture-of-experts architecture
- Transformer-aided guard: A hybrid spatio-temporal framework for confidence-aware intrusion detection in cyber-physical systems
- A multi-objective bayesian optimized neural network approach for intrusion detection
BibTeX
@article{shareef2026adaptive,
title = {{Adaptive active learning and metaheuristic-optimized transformer framework for robust intrusion detection in software-defined networks}},
author = {S. K. Khaja Shareef and Manjunath Chinthakunta and Alpha Vijayan and C. R. Aditya and Kranthi Kumar Lella and Srihari Varma Mantena and Ch Koteswararao},
journal = {Scientific Reports},
year = {2026},
month = oct,
doi = {10.1038/s41598-026-76361-8},
url = {https://www.nature.com/articles/s41598-026-76361-8},
note = {CC BY 4.0},
}
RIS
TY - JOUR
TI - Adaptive active learning and metaheuristic-optimized transformer framework for robust intrusion detection in software-defined networks
AU - S. K. Khaja Shareef
AU - Manjunath Chinthakunta
AU - Alpha Vijayan
AU - C. R. Aditya
AU - Kranthi Kumar Lella
AU - Srihari Varma Mantena
AU - Ch Koteswararao
PY - 2026
DA - 2026/10/25
JO - Scientific Reports
DO - 10.1038/s41598-026-76361-8
UR - https://www.nature.com/articles/s41598-026-76361-8
AB - Existing intrusion detection systems largely rely on static supervised learning models that require extensive labeled data and periodic retraining. Such approaches struggle to adapt to evolving attack patterns in dynamic software-defined networks. To address these limitations, this study proposes an adaptive intrusion detection framework that integrates uncertainty-driven active learning, metaheuristic-based feature selection, Transformer-based attack classification, and adaptive hyperparameter optimization within a unified software-defined networking architecture. Unlike conventional adaptive intrusion detection systems that rely on static feature representations or fixed learning strategies, the proposed framework continuously refines both the training data and model configuration to improve robustness against evolving cyberattacks. The proposed framework iteratively identifies informative samples for annotation, optimizes feature subsets using adaptive search, and continuously updates the classifier to maintain high detection performance under changing traffic distributions. The proposed system was evaluated using the ToN-IoT dataset and additional real-world traffic traces. Experimental evaluation on benchmark and real-world network traffic datasets demonstrated a detection accuracy of up to 97.92% and an F1-score of 97.10%. Although the optimization stage increases offline training time, the optimized model maintains efficient inference during deployment, making it suitable for practical software-defined network environments. Performance was evaluated over five independent runs using different random initialization seeds. Although the optimization and active-learning stages increase offline training time, the optimized model maintains efficient inference during deployment. Performance was evaluated over five independent runs using different random initialization seeds. The results demonstrate that the complementary use of adaptive sample acquisition, feature selection, and hyperparameter optimization provides an effective intrusion-detection framework for software-defined network environments.
SN - 2045-2322
ER -