A Lightweight Transformer-PNN Model for Efficient Network Intrusion Detection

With the proliferation of sophisticated cyberattacks, traditional intrusion detection systems (IDS) face mounting challenges in balancing detection accuracy and real-time performance. Existing deep learning–based IDS methods, such as Transformer-CNN and Transformer-LSTM hybrids, often incur high inference latency or struggle with rare-event detection under small-sample conditions In this paper, we propose a novel hybrid architecture that integrates a lightweight Transformer variant, Fastformer, for global temporal feature extraction with a Probabilistic Neural Network (PNN) for efficient and interpretable classification. The Fastformer module leverages additive attention to achieve linear complexity in sequence length, while the PNN component computes class posterior probabilities via Gaussian kernel–based prototype matching. We evaluate the proposed model on two benchmark datasets—NSL-KDD, a refined version of KDD’99 with 125 973 training and 22 544 testing samples, and CICIDS2017, which contains realistic benign and diverse attack flows. Experimental results show that our Fastformer-PNN model attains 98.7 % accuracy with 6.2 ms average inference latency on NSL-KDD, and 99.2 % accuracy with 9.4 ms latency on CICIDS2017—surpassing Transformer-CNN and Transformer-LSTM baselines by at least 1.2 % in F1-score and reducing latency by 35 %. Furthermore, the PNN’s prototype-based decision mechanism enhances interpretability by visualizing feature-to-class prototype distances, aiding threat analysis. Thanks to its lightweight design, the model is well-suited for deployment in resource-constrained and edge computing environments, enabling next-generation real-time IDS applications. To our knowledge, this work is the first to fuse a lightweight Transformer with a PNN classifier for network intrusion detection, offering a practical, high-performance, and interpretable solution for cybersecurity defense.