An episodic prototypical embedding modulated transformer (EPMT) for network intrusion detection

The rapid growth of Internet of Things (IoT) and Internet of Medical Things (IoMT) deployments has made intrusion detection harder, with high-dimensional flow representations, severe class imbalance, and attack families that appear with few labelled examples. This study proposes an Episodic Prototypical Embedding-Modulated Transformer (EPMT), which differs from prior work less in its components than in how feature relevance enters the model. A multi-criteria ranking stage combines correlation, ANOVA F -statistic, mutual information, and recursive feature elimination through the Technique for Order of Preference by Similarity to Ideal Solution (TOPSIS) to produce a continuous relevance score for every feature, and the resulting subset is combined with an episode-level context vector through a feature-wise linear modulation (FiLM) layer inside the transformer. Classification is performed by prototypical metric learning under an episodic meta-learning objective. We evaluate on RT-IoT-2022, CIC-IoT-2023, and CIC-IoMT-2024-WiFi-MQTT under a stratified cross-validation protocol, reporting macro-averaged precision, recall, and \(F_1\) alongside accuracy and area under the receiver operating characteristic curve, since accuracy is dominated by majority classes in all three benchmarks. Under its selected sequence length and ADASYN configuration, EPMT reaches a macro \(F_1\) of 80.32% on RT-IoT-2022, 42.45% on CIC-IoT-2023, and 56.25% on CIC-IoMT-2024, consistently ahead of a plain transformer, a meta-learned transformer without FiLM, and a FiLM-conditioned transformer without episodic training on every dataset and every principal metric. We report this consistent ordering as evidence of a directionally robust improvement rather than definitive statistical superiority: under a three-fold cross-validation protocol with correspondingly limited statistical power, only one of nine pairwise comparisons, EPMT against the plain transformer on RT-IoT-2022, remains significant after Holm correction. Per-class confusion matrices and receiver operating characteristic curves are reported for the selected configuration on all three datasets, and show that the gap between accuracy and macro-averaged \(F_1\) has a different source on each benchmark. We additionally report a diagnostic finding of independent interest: two of the three benchmarks are distributed in class-contiguous record order, so sliding-window sequence construction over them aggregates same-class records rather than modelling traffic dynamics, which inflates measured performance under record-level cross-validation. We quantify this effect and discuss its implications for sequence-based evaluation on these datasets, and we report a substantially more conservative estimate of RT-IoT-2022 performance under a strict temporal hold-out. We treat the fixed, dataset-level feature-selection protocol, together with the comparison against published baselines evaluated under different protocols, as open points that bound the strength of the claims made here, and we discuss each explicitly rather than treating the reported numbers as a settled comparison.