NIDS Using Hierarchical Attack Structure and Transformer

As network technologies rapidly advance and organizational operations increasingly rely on networked systems, cyberattacks have become more sophisticated, posing widespread threats. Consequently, distinguishing malicious network traffics from normal ones has become a critical task to safeguard the organizational infrastructures and ensure the integrity and reliability of networked systems. To address this, numerous network intrusion detection systems have been developed and studied on various network traffic datasets. In this paper, we present a novel approach featuring a transformer-based two-level classification, where a transformer classification is applied to each of the two hierarchical attack levels. Specifically, binary classification is performed to distinguish between normal and attack traffic, followed by multiclass classification to identify specific types of network attacks. Experimental results on the CICIDS-2017 dataset demonstrate a reduction of false negatives (i.e., the misclassification of attacks as normal traffic), which is a crucial factor for security-sensitive systems. Specifically, it achieved an accuracy of O.9874(±0.0010) and an F1-score of 0.9924(±0.0006) for binary classification, and an accuracy of 0.9976(±0.0002) and an F1-score of 0.9715(±0.0035) in multiclass classification. Additionally, the comparative analysis with existing approaches highlights the effectiveness of our method in achieving enhanced classification performance for both binary classification and multiclass attack detection.