ResDNViT: A hybrid architecture for Netflow-based attack detection using a residual dense network and Vision Transformer

The fast evolution of technologies like wireless sensor networks, cloud computing services, advanced AI driven applications and the Internet of Things (IoT) have led to increased reliance on internet by both individual users and enterprises—both small and large. On the contrary, the advancements in cybersecurity have not matched this pace consequently attracting exponentially rising trends of cyberattacks in the past decade. To enhance network security, this work proposes ResDNViT, a robust model integrating a self-attention-based Vision Transformer (ViT) architecture with a simplified ResNet-based architecture for NetFlow-based attack detection. Motivated by the strong performance of transformers in tasks related to NLP and computer vision, ResDNViT extends the ViT-based architecture for network traffic analysis by expressing NetFlow features as 2D matrices, and splitting them into equal-sized sub-matrices, that are used as input patches for the encoder component. A simplified residual dense network (ResDN) with two residual dense blocks (RDB) is stacked to the encoder’s output layer for classification. The novelty of this approach lies in effectively adapting the ViT-based architecture, originally designed for images, to analyzing NetFlow packets for attack classification. The model was evaluated on four well-studied benchmark datasets: the CICIDS2017_improved, Bot-IoT, CICIoT2022, and N-BaIoT, demonstrating an impressive performance across various classification tasks. The proposed approach’s ability to detect traffic from unseen device kinds was assessed by grouping devices from N-BaIoT into five categories based on usage: Thermostats, Baby Monitors, Doorbells, Security Cameras and Webcams. The model was trained using samples from four categories at a time and tested on samples from the remaining category. A high performance across metrics including accuracy, precision, recall, and F1-score for all categories highlighted the model’s robustness in traffic discrimination. • Combines a ViT-encoder and simplified ResNet-based architecture. • Proposed model removes conv layers, avoiding local spatial dependencies of ResNet. • Enhanced NetFlow attack detection over state-of-the-art detection methods. • Model adapts to unseen device types, removing need for retraining on new devices.