MTRC: A self-supervised network intrusion detection framework based on multiple Transformers enabled data reconstruction with contrastive learning

Nowadays, Network Intrusion Detection System (NIDS) is essential for identifying and mitigating network threats in increasingly complex and dynamic network environments. Due to the benefits of automatic feature extraction and powerful expressive capability, Deep Neural Networks (DNN) based NIDS has witnessed great deployment. Considering the extremely high annotation cost, i.e., the extreme difficulty of labeling anomalous samples in supervised DNN based NIDS schemes, practically, many NIDS schemes are unsupervised. which either use generative-based approaches, such as encoder-decoder structure to identify deviated samples without the labeled intrusion data, or employ discriminative-based methods by designing pretext tasks to construct additional supervisory signals from the given data. However, the former only generates a single reconstruction version for each input sample, lacking a holistic view of the latent distribution of input sample, while the latter focuses on learning the global perspective of samples, often neglecting internal structures. To address these issues, this paper proposes a novel self-supervised NIDS framework based on multiple Transformers enabled data reconstruction with contrastive learning, MTRC, through combining generative-based and discriminative-based paradigms. In detail, our paper's contributions are threefold. First, a cross-feature correlation module is proposed to convert each tabular network traffic record into an original data view that effectively captures the cross-feature correlations. Second, inspired by the idea of the multiple-view reconstruction and contrastive learning, multiple Encoder-Decoder structured Transformers are used to generate different views for each original data view, which intentionally make each reconstructed view semantically similar to the original data view, and while these reconstructed views diversified between each other, aiming to holistically capture the latent features of normal data samples. Experimental results on multiple real network traffic datasets demonstrate that MTRC outperforms state-of-the-art unsupervised and self-supervised NIDS schemes, achieving superior performance in terms of AUC-ROC, AUC-PR, and F1-score metrics. The MTRC source code is publicly available at: https://github.com/sunyifen/MTRC.