Research on a Network Intrusion Detection Method Based on LSTM and Transformer

Network intrusion detection is an important part of cybersecurity defense. Deep learning models have been widely used for this task, but it remains unclear whether the high performance reported in top-journal studies comes from model-structure innovation or from data-engineering methods. To address this problem, this study proposes a lightweight LSTM-Transformer fusion model. A bidirectional LSTM is used to extract local temporal features, and a single-layer Transformer encoder is used to model global dependencies. Experimental results on the NSL-KDD dataset show that, with fewer parameters and a shorter training time, the model achieves an F1 value of 0.7745, which is 2.97 percentage points higher than that of a pure Transformer. Further decomposition shows that data engineering accounts for about 68% of the performance improvement, while the model reaches only 32.90% accuracy on attack types unseen in the training set.