A Malicious Traffic Detection Model Based on Autoencoder and Multihead Attention Mechanism

The proliferation of 5G, the Internet of Things (IoT), and cloud services has significantly increased the scale and complexity of network traffic, leading to growing cybersecurity challenges, particularly for real-time detection on resource-constrained edge devices. To address this, we propose the encoder and multihead attention (EMA) model, a lightweight and efficient malicious traffic detection approach that integrates autoencoder-based dimensionality reduction with a multihead attention mechanism. The EMA model reduces computational cost while preserving high detection accuracy, making it suitable for real-time edge computing environments. It compresses high-dimensional raw traffic data using an autoencoder and employs an attention mechanism to highlight critical features and preserve essential patterns. We further evaluate different activation functions, namely rectified linear unit (ReLU), leaky ReLU, and exponential linear unit (ELU), within the autoencoder to optimize performance. Experiments on the UNSW-NB15 dataset show that EMA achieves 98.48% accuracy, comparable to gated recurrent unit (GRU)-based intrusion detection system (IDS) models, while reducing training and prediction times by 85.41% and 60.24%, respectively. Evaluation on the CICIoT2023 dataset further demonstrates its effectiveness and generalizability to modern IoT threat environments. EMA offers a promising solution for balancing accuracy and efficiency in malicious traffic detection, particularly in next-generation, high-speed, and resource-constrained networks.