MFT: A novel memory flow transformer efficient intrusion detection method

Abstract

Intrusion detection is a critical field in network security research that is devoted to detecting malicious traffic or attacks on networks. Even with the advances in today's Internet environment, a lot of intrusion detection techniques still fail to take into account the long-term characteristics present in network data, which results in a high false alarm rate. Some researchers have tried to address this problem by using the traditional transformer model; however, it is not very effective when dealing with complex relationships and the subtle classification requirements of large amounts of sequential data. This work presents a novel solution called the memory flow transformer (MFT) in response to the limitations of the conventional transformer model. By utilizing a carefully designed memory flow structure, MFT transcends traditional limitations and makes it possible to obtain complex long-term features from network traffic. This innovation enables the model to identify deep connections at a finer level between a wide variety of network traffic data. Extensive experiments were carried out on the complex CICIDS 2017 and NSL-KDD datasets to validate the effectiveness of the MFT model. The results were outstanding, demonstrating MFT's powerful detection abilities. With regard to performance metrics like accuracy, F1 score, false alarm rate, and training time, MFT is superior to current state-of-the-art approaches. Network security is greatly strengthened by MFT, which provides practitioners in the intrusion detection field with novel and effective techniques.