Semi-Supervised Network Anomalous Traffic Detection Based on a Reconstruction Transformer
DOI:
https://doi.org/10.54097/k1f15653Keywords:
Anomaly detection, Transformer, Autoencoder, Semi-supervised learning, Network trafficAbstract
The continuous evolution of cyberattack techniques poses severe challenges to traditional rule- and signature-based intrusion detection systems. This paper proposes a semi-supervised network anomalous traffic detection method based on a reconstruction Transformer autoencoder (RTAE-AD). The model is trained using only normal traffic data. A self-attention mechanism performs encoding-bottleneck-decoding reconstruction on traffic feature sequences, and the mean squared error (MSE) reconstruction error is used as the anomaly score. Experiments on the KDDCup99 dataset show that, under semi-supervised conditions requiring only normal traffic labels, the proposed method achieves an AUC-ROC of 0.9959, an AUC-PR of 0.9266, a best F1 score of 0.9482, and a false-positive rate of only 0.11%. Compared with conventional methods such as PCA+SVM, AE, and LSTM-AE, the proposed method provides significantly better detection performance. The model contains only 206,000 parameters and therefore has favorable potential for lightweight deployment.
Downloads
References
[1] Long, Z., Yan, H., Shen, G., Zhang, X., & He, H. (2024). A transformer-based network intrusion detection approach for cloud security. Journal of Cloud Computing, 13, Article 5. https://doi.org/10.1186/s13677-024-00614-0 DOI: https://doi.org/10.1186/s13677-023-00574-9
[2] Hu, Z., Liu, G., Li, Y., Liu, Y., & Gu, Z. (2024). SAGB: Self-attention with gate and BiGRU network for intrusion detection. Complex & Intelligent Systems, 10, 8467-8479. https://doi.org/10.1007/s40747-024-01480-4 DOI: https://doi.org/10.1007/s40747-024-01577-y
[3] Dong, S., Su, H., & Liu, Y. (2023). A-CAVE: Network abnormal traffic detection algorithm based on variational autoencoder. ICT Express, 9(5), 896-902. https://doi.org/10.1016/j.icte.2022.12.011 DOI: https://doi.org/10.1016/j.icte.2022.11.006
[4] Han, X., Cui, S., Liu, S., Zhang, H., & Yang, J. (2023). Network intrusion detection based on n-gram frequency and time-aware transformer. Computers & Security, 128, Article 103171. https://doi.org/10.1016/j.cose.2023.103171 DOI: https://doi.org/10.1016/j.cose.2023.103171
[5] Kamal, H., & Mashaly, M. (2025). AE-DTNN: Autoencoder-Dense-Transformer neural network model for efficient anomaly-based intrusion detection systems. Machine Learning and Knowledge Extraction, 7(3), Article 78. https://doi.org/10.3390/make7030078 DOI: https://doi.org/10.3390/make7030078
[6] Wang, P., Song, Y., Wang, X., Zhao, Y., & Liu, J. (2025). ImagTIDS: An internet of things intrusion detection framework utilizing GADF imaging encoding and improved transformer. Complex & Intelligent Systems, 11, Article 93. https://doi.org/10.1007/s40747-024-01706-5 DOI: https://doi.org/10.1007/s40747-024-01712-9
[7] Salehiyan, A., Moghaddam, P. S., & Kaveh, M. (2025). An optimized transformer-GAN-AE for intrusion detection in edge and IIoT systems: Experimental insights from WUSTL-IIoT-2021, EdgeIIoTset, and TON_IoT datasets. Future Internet, 17(7), Article 279. https://doi.org/10.3390/fi17070279 DOI: https://doi.org/10.3390/fi17070279
[8] Haque, A., & Soliman, H. (2025). A transformer-based autoencoder with Isolation Forest and XGBoost for malfunction and intrusion detection in wireless sensor networks for forest fire prediction. Future Internet, 17(4), Article 164. https://doi.org/10.3390/fi17040164 DOI: https://doi.org/10.3390/fi17040164
[9] Yu, H., Yang, W., Cui, B., Wang, H., & Zhang, H. (2024). Renyi entropy-driven network traffic anomaly detection with dynamic threshold. Cybersecurity, 7, Article 64. https://doi.org/10.1186/s42400-024-00314-5 DOI: https://doi.org/10.1186/s42400-024-00249-1
[10] Zhang, Y., Song, J., Sun, Y., Jiang, Y., & Guo, H. (2025). Federated two-stage transformer-based network for intrusion detection in non-IID data of controller area networks. Cybersecurity, 8, Article 29. https://doi.org/10.1186/s42400-025-00341-w DOI: https://doi.org/10.1186/s42400-024-00329-2
Downloads
Published
Issue
Section
License
Copyright (c) 2026 Journal of Computing and Electronic Information Management
This work is licensed under a Creative Commons Attribution-NonCommercial 4.0 International License.
