Pith. sign in

REVIEW 4 major objections 6 minor 1 cited by

Self-Supervised Transformer-based Contrastive Learning for Intrusion Detection Systems

T0 review · 4 major / 6 minor · reviewed 2026-08-15 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read This paper claims that a transformer pretrained on unlabeled packet sequences with a packet-mixing augmentation learns flow representations that outperform handcrafted NetFlow features, especially in cross-dataset anomaly detection.

desk verdict New augmentation for packet-level contrastive learning, honest evaluation, but header-only representation limits the zero-day generalization claim. read the letter →

arxiv 2505.08816 v1 pith:3IB2TC6F submitted 2025-05-12 cs.CR cs.LG

Ippokratis Koukoulis , Ilias Syrigos , Thanasis Korakis This is my paper · ORCID
classification cs.CRcs.LG
keywords intrusiondetectionself-supervisedlearningcontrastivetransformerencoderspacketsequencesflowrepresentationszero-dayattacksNet
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper sets out to establish that a transformer encoder, pretrained with self-supervised contrastive learning on unlabeled packet header sequences, can produce flow representations that generalize across network environments better than handcrafted NetFlow statistics. Its experiments show that with a simple augmentation that splices a contiguous block from another flow into a given flow, the model reaches up to 3% higher AUC than a NetFlow-based self-supervised baseline on the same dataset, and up to 20% higher AUC when training and testing sets come from different datasets. The paper also claims that pretraining gives a strong starting point for supervised intrusion detection when labels are scarce, improving few-shot fine-tuning by up to 2.5% AUC over random initialization and supporting transfer learning from one dataset's benign traffic to another. A sympathetic reader would take the central claim to be that packet-sequence contrastive learning with a transformer is a label-free route to intrusion detection that transfers across domains.

What carries the argument

The load-bearing mechanism is the packet-token embedding combined with the packet-replacement augmentation inside a contrastive learning loop. Each packet is collapsed into a single token by embedding its five header fields with field-specific functions — categorical features through embedding layers, numerical features through linear projections — then concatenating and projecting to a 256-dimensional vector with a shared position embedding. A 4-layer BERT-style encoder stack processes the token sequence, and the [CLS] token's representation is passed through a projection head during pretraining that is discarded at inference. The augmentation selects a random contiguous patch of length $\lambda \cdot L$ from another flow and splices it into the original flow, and the NT-Xent loss (temperature 0.5, $\lambda = 0.4$) pulls the original and spliced views together while pushing other flows in the batch apart. The CutMix-style splicing is what makes positives genuinely hard and forces the model to use non-discriminative packet structure rather than a single distinctive packet.

What would settle it

Run the model's unsupervised scoring on a dataset whose attacks are visible only in payload bytes (for example, SQL injection strings in HTTP bodies) and compare against a payload-reading baseline; if the header-only model stays near chance while the payload reader succeeds, the cross-domain generalization claim fails for the very attack class the authors' own labeling excludes.

Watch

Extended reading notes

Core claim

The central discovery is that a BERT-style transformer encoder pretrained with the NT-Xent contrastive objective and a CutMix-style packet-replacement augmentation learns flow-level representations from unlabeled packet sequences that outperform self-supervised models trained on aggregate NetFlow features. In the authors' construction, each packet becomes a single token built from five header-derived fields — IP protocol, packet length, TCP flags, inter-arrival time, and direction — and the [CLS] token's output serves as the flow embedding. Across four benchmark datasets, the reported AUC-ROC gains reach up to 3% in intra-dataset anomaly detection, up to 20% in inter-dataset anomaly detection, and up to 1.5% in few-shot supervised fine-tuning relative to the NetFlow baseline, with cross-dataset transfer matching or exceeding the baseline in nearly all configurations. The claim is that packet-level sequence structure carries attack signal that aggregate flow statistics miss, and that this signal transfers to networks the model was not trained on.

Load-bearing premise

The entire pipeline assumes that five header-derived quantities — IP protocol, packet length, TCP flags, inter-arrival time, and direction — truncated to the first 32 packets or 120 seconds, contain enough attack signal; attacks visible only in payload content are outside what the model can ever see.

Editorial extensions

If this is right

  • Anomaly detection can run without any labels: an unseen flow is scored by its maximum cosine similarity to a reference set of benign flows, and low similarity flags a candidate zero-day attack.
  • Cross-network deployment becomes practical: a model pretrained on one network's unlabeled benign traffic can be fine-tuned on 0.1% of a target dataset's labels and still beat randomly initialized weights by up to 2.5% AUC.
  • Few-shot supervised intrusion detection can operate with very small labeled corpora, because pretraining supplies the flow-structure prior and only a small labeled set is needed to train the classification head.
  • A packet-sequence representation generalizes across environments better than aggregate NetFlow statistics, with up to 20% higher AUC in inter-dataset anomaly detection.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Because the representation is built entirely from five header fields, the model is blind to payload-only attacks; a natural extension is to add a learned payload token and measure whether the inter-dataset margins survive.
  • The truncation to the first 32 packets or 120 seconds is an implicit claim about early-flow behavior; sweeping the truncation window (e.g., 8, 16, 64 packets) would reveal how much context the cross-network gains depend on.
  • The same pretrained encoder could be used as a starting point for other flow-level tasks such as traffic classification or protocol identification, since the contrastive objective is task-agnostic and the paper only evaluates it on intrusion detection.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 6 minor

Summary. The paper proposes a self-supervised contrastive learning framework for intrusion detection in which a BERT-style transformer encoder is pretrained on unlabeled benign traffic flows, using individual packets as tokens. Each packet is represented by five header-derived features, and a CutMix-like augmentation replaces a contiguous segment of a flow's packets with packets from another flow to create positive pairs for an NT-Xent contrastive loss. The pretrained encoder is evaluated in two settings: unsupervised anomaly detection, where the maximum cosine similarity between a test flow representation and benign training flows is used as an anomaly score, and few-shot supervised fine-tuning, where a small labeled set is used to train a classifier. Experiments on CICIDS2017, UNSW-NB15, CTU-13, and CIC-DDoS2019 compare the proposed model against a contrastively trained DNN on NetFlow statistics and a supervised NetFlow DNN. The paper reports that the packet transformer achieves up to 3% higher AUC in intra-dataset unsupervised evaluation, up to 20% higher AUC in inter-dataset unsupervised evaluation, and up to 1.5% higher AUC in few-shot supervised fine-tuning compared with the self-supervised NetFlow baseline.

Significance. If the reported results are statistically robust, the paper would provide a useful demonstration that a transformer pretrained on unlabeled packet sequences can learn transferable flow representations that outperform handcrafted NetFlow statistics for header-visible anomalies. The cross-dataset evaluation is a meaningful and difficult test, and the decision to pretrain only on benign traffic is a sensible way to avoid label leakage. The strengths include the clear description of the architecture, tokenization, augmentation, and evaluation protocol, as well as the release of source code. However, the significance is currently limited by two issues: the input representation is not actually 'raw packets' but a small, hand-picked set of header fields, and all reported results are single runs without error bars or significance tests. Consequently, the scope of the zero-day and generalizability claims is narrower than the paper states, and the size of the claimed improvements may not survive statistical scrutiny.

major comments (4)
  1. [Section III and Section V] The input representation is restricted to five header-derived fields (IP protocol, packet length, TCP flags, inter-arrival time, direction) truncated to the first 32 packets or 120 seconds, so the model never reads packet payloads. This contradicts the abstract's claim of learning from 'raw packet sequences' and 'comprehensive packet sequence representations.' In fact, for the CICIDS Web Attack, Infiltration, and Botnet classes, the paper states that flows are considered malicious only if they 'actually carry payload during the published attack time frame' (Section V), even though the model's features cannot access that payload. The inter-dataset gains in Tables II and III therefore support generalization only for header-visible anomalies; a payload-only attack with normal-looking headers is statistically indistinguishable from benign traffic under this representation. The authors should either incorporate payload bytes into the tokenization or explicitly state and discuss this limitation in the abstract and conclusions.
  2. [Section V-B and Tables II-IV] All AUC values are reported as single runs without error bars, confidence intervals, or significance tests. The claimed improvements are modest in the intra-dataset (up to 3%) and few-shot (up to 1.5%) settings, and such margins can easily arise from random seed, initialization, or data-split variation. To support the headline claim of 'better performance,' the paper should report means and standard deviations over multiple seeds and apply a paired significance test (e.g., Wilcoxon signed-rank or bootstrap) for each pairwise comparison.
  3. [Section V-C and Tables V-VIII] The few-shot fine-tuning uses 0.1% of all labeled data, but the paper does not describe how the labeled subset is sampled (e.g., stratification, class balance, random seed) or how the validation set is constructed. With such a small sample, the reported AUC improvements (up to 1.5% over pretrained NetFlow DNN, up to 0.9% for transfer) may be highly dependent on the particular labeled draw. The paper should report results over multiple random labeled subsets and provide the standard deviation.
  4. [Section IV-E and Related Work] The paper claims that masking-based augmentations (e.g., [25]) are inefficient because 'the augmented sample barely differs from the original' and that content-altering augmentations are superior, but no experiment compares the proposed CutMix-style packet replacement against masking or other packet-level augmentations. Without such an ablation, the specific contribution of the proposed augmentation process is not established; the observed gains could be due to the transformer architecture, the contrastive objective, or the input features rather than the augmentation. Please add an ablation study isolating the augmentation choice.
minor comments (6)
  1. [Throughout] Several typos and grammatical errors appear: 'transformed-based' in the Conclusions, 'scenarrio' in Section V-B, 'a a' in Related Work, and a stray 'ay' at the end of the CTU-13 bullet in Section V.
  2. [Algorithm 1] Algorithm 1 does not specify how the sampled flow u is matched in sequence length to x^{(i)}; if all sequences are padded to a common maximum length, the replacement interval may include padding tokens, which should be clarified.
  3. [Section III] The tokenization procedure says each packet header is encoded as a 4-byte unsigned integer, but the mapping from the five header features to that integer is not specified; please provide the exact packing/concatenation details for reproducibility.
  4. [Section IV-B, Eq. (1)] Equation (1) defines scaled dot-product attention in the usual form but does not define how Q, K, V are obtained from the packet-token embeddings; please state the projection dimensions and whether bias terms are used.
  5. [Section V-B, Eq. (3)] In the unsupervised anomaly detection score, using the maximum cosine similarity over all benign training flows introduces a monotone bias with the size of the benign training set; consider reporting a normalized score or a percentile statistic.
  6. [Tables VII and VIII] Tables VII and VIII report transfer-learning AUCs but do not show the randomly-initialized baseline in the same table, so the claimed improvement over random initials is not directly visible; include the baseline columns or a separate comparison.

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity: pretraining, anomaly scoring, and fine-tuning evaluations are self-contained against held-out labels.

full rationale

The paper's derivation chain is not circular. The transformer is pretrained with the NT-Xent contrastive loss on unlabeled benign flows only; labels are introduced only at evaluation time. The unsupervised anomaly score is the maximum cosine similarity between a test flow representation and held-out training benign flow representations (Eq. 3), and AUC is computed against test labels that never participated in pretraining. The few-shot and transfer-learning experiments likewise compare pretrained versus randomly initialized weights under the same downstream protocol, so the reported gains are empirical outcomes rather than outcomes forced by construction. Hyperparameters such as the temperature (τ=0.5) and augmentation ratio (λ=0.4) are stated a priori rather than fitted to the test set. The paper contains no load-bearing self-citations and does not invoke a uniqueness theorem or rename a known result as a derivation. The main caveat, that the packet representation is header-only and therefore cannot directly expose payload-only attacks, is a limitation on the scope of the zero-day claim, not a circularity in the method.

Assumptions & free parameters 6 free parameters · 6 assumptions · 0 invented entities

The central claim rests on hand-set hyperparameters and on domain assumptions about header-only representation, flow truncation, augmentation validity, max-similarity scoring, and label quality. These are not invented physical entities and none are fitted to the test AUC in a circular way, but they are the burden the empirical results carry.

free parameters (6)
  • Augmentation ratio lambda = 0.4
    Section V-A sets lambda=0.4 for all experiments; this controls how much of a packet sequence is replaced in a positive pair and is central to the method. No sensitivity analysis is reported.
  • Temperature tau = 0.5
    NT-Xent temperature in Eq. 2; hand-set, affects the contrastive loss gradient and the hardness of negative pairs.
  • Pretraining duration = 1 epoch
    All self-supervised models are trained for a single epoch with no convergence check or learning-rate schedule; results may depend on this choice.
  • Flow truncation = 32 packets / 120 s timeout
    Defines the input representation for both packet and NetFlow data; not ablated. Attacks that occur later in a flow are invisible to both models.
  • Model dimensions = d=256, 4 heads, 4 layers, dropout 0.1
    Chosen architecture in Section IV-B; no ablation justifies these sizes or the number of layers.
  • Few-shot labeled fraction = 0.1% of labeled data
    Evaluation regime in Section V-C; the reported improvement from pretraining may vary with this fraction.
assumptions (6)
  • standard math Scaled dot-product self-attention (Eq. 1) and NT-Xent loss (Eq. 2) are well-defined objectives that drive useful representations.
    The paper invokes the standard transformer and contrastive learning machinery without proving convergence or representation quality; this is accepted background, not a new assumption.
  • domain assumption The chosen packet header fields (IP protocol, packet length, TCP flags, inter-arrival time, direction) capture enough signal to separate attacks from benign traffic.
    Section III and Table I define the packet token from these fields only; the claim that no shortcuts remain rests on this assumption.
  • domain assumption Truncating flows to the first 32 packets or 120 seconds preserves attack evidence.
    Section III sets these thresholds for both packet sequences and NetFlow; any attack occurring later is invisible to both models.
  • domain assumption Swapping a random contiguous block of packets from another flow creates a valid positive view of the original flow.
    Algorithm 1 and Section IV-E rely on this CutMix-style assumption; if the swapped segment changes the flow's semantics, the contrastive objective learns the wrong invariance.
  • domain assumption Max cosine similarity to known benign flows (Eq. 3) is a valid anomaly score for unseen flows.
    Section V-B defines the unsupervised evaluation this way; the AUC numbers inherit this assumption.
  • domain assumption The dataset labels, including the CICIDS2017 relabeling and payload-window filtering, are correct enough to measure AUC.
    Section V describes relabeling according to [31], [35]; label errors propagate directly into every reported number.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Self-Supervised Transformer-based Contrastive Learning for Intrusion Detection Systems." pith.science (2026). https://pith.science/paper/3IB2TC6F

@misc{pith2026250508816,
  author       = {Pith},
  title        = {Pith review of: Self-Supervised Transformer-based Contrastive Learning for Intrusion Detection Systems},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/3IB2TC6F}},
  note         = {Machine review of arXiv:2505.08816}
}
read the original abstract

As the digital landscape becomes more interconnected, the frequency and severity of zero-day attacks, have significantly increased, leading to an urgent need for innovative Intrusion Detection Systems (IDS). Machine Learning-based IDS that learn from the network traffic characteristics and can discern attack patterns from benign traffic offer an advanced solution to traditional signature-based IDS. However, they heavily rely on labeled datasets, and their ability to generalize when encountering unseen traffic patterns remains a challenge. This paper proposes a novel self-supervised contrastive learning approach based on transformer encoders, specifically tailored for generalizable intrusion detection on raw packet sequences. Our proposed learning scheme employs a packet-level data augmentation strategy combined with a transformer-based architecture to extract and generate meaningful representations of traffic flows. Unlike traditional methods reliant on handcrafted statistical features (NetFlow), our approach automatically learns comprehensive packet sequence representations, significantly enhancing performance in anomaly identification tasks and supervised learning for intrusion detection. Our transformer-based framework exhibits better performance in comparison to existing NetFlow self-supervised methods. Specifically, we achieve up to a 3% higher AUC in anomaly detection for intra-dataset evaluation and up to 20% higher AUC scores in inter-dataset evaluation. Moreover, our model provides a strong baseline for supervised intrusion detection with limited labeled data, exhibiting an improvement over self-supervised NetFlow models of up to 1.5% AUC when pretrained and evaluated on the same dataset. Additionally, we show the adaptability of our pretrained model when fine-tuned across different datasets, demonstrating strong performance even when lacking benign data from the target domain.

Figures

Figures reproduced from arXiv: 2505.08816 by the authors.

Figure 1
Figure 1. Overall architecture of the transformer-based model [PITH_FULL_IMAGE:figures/full_fig_p004_1.png] view at source ↗
Figure 2
Figure 2. Overview of the augmentation and contrastive learning [PITH_FULL_IMAGE:figures/full_fig_p005_2.png] view at source ↗

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. A Quantum Genetic Algorithm-Enhanced Self-Supervised Intrusion Detection System for Wireless Sensor Networks in the Internet of Things

    cs.CR 2025-09 reject novelty 4.0 of 10

    A hybrid QGA-SSL intrusion detection method claims to outperform existing IDS on NSL-KDD and UNSW-NB15, but without reproducible evidence.

Reference graph

Works this paper leans on

37 extracted references · 24 canonical work pages · cited by 1 Pith paper

  1. [25]

    Contrastive learning enhanced intrusion detection,

    Y . Yue, X. Chen, Z. Han, X. Zeng, and Y . Zhu, “Contrastive learning enhanced intrusion detection,”IEEE Transactions on Network and Service Management, vol. 19, no. 4, pp. 4232–4247, 2022

    2022

  2. [1]

    [Online]

    Rapid7 2024 Attack Intelligence Report. [Online]. Available: https://www.rapid7.com/research/report/ 2024-attack-intelligence-report/

    work page 2024

  3. [2]

    [Online]

    Cost of a Data Breach Report 2024. [Online]. Available: https://www.ibm.com/reports/data-breach

    work page 2024

  4. [3]

    Should I Raise The Red Flag? A comprehensive survey of anomaly scoring methods toward mitigating false alarms

    Z. Zohrevand and U. Gl ¨asser, “Should i raise the red flag? A comprehensive survey of anomaly scoring methods toward mitigating false alarms,”arXiv preprint arXiv:1904.06646, 2019

    work page Pith review arXiv 1904

  5. [4]

    A simple framework for contrastive learning of visual representations,

    T. Chen, S. Kornblith, M. Norouzi, and G. Hinton, “A simple framework for contrastive learning of visual representations,” in International conference on machine learning. PMLR, 2020, pp. 1597–1607

    2020

  6. [5]

    Simcse: Simple contrastive learning of sentence embeddings,

    T. Gao, X. Yao, and D. Chen, “Simcse: Simple contrastive learning of sentence embeddings,”arXiv preprint arXiv:2104.08821, 2021

    arXiv 2021

  7. [6]

    Scarf: Self-supervised contrastive learning using random feature corruption,

    D. Bahri, H. Jiang, Y . Tay, and D. Metzler, “Scarf: Self-supervised contrastive learning using random feature corruption,”arXiv preprint arXiv:2106.15147, 2021

    arXiv 2021

  8. [7]

    Saint: Improved neural networks for tabular data via row attention and contrastive pre-training,

    G. Somepalli, M. Goldblum, A. Schwarzschild, C. B. Bruss, and T. Goldstein, “Saint: Improved neural networks for tabular data via row attention and contrastive pre-training,”arXiv preprint arXiv:2106.01342, 2021

    arXiv 2021

Show all 37 references
  1. [8]

    Sscl-ids: Enhancing generalization of intrusion detection with self-supervised contrastive learning,

    P. Golchin, N. Rafiee, M. Hajizadeh, A. Khalil, R. Kundel, and R. Steinmetz, “Sscl-ids: Enhancing generalization of intrusion detection with self-supervised contrastive learning,” in2024 IFIP Networking Conference (IFIP Networking). IEEE, 2024, pp. 404–412

    2024

  2. [9]

    A new hope for network model generalization,

    A. Dietm ¨uller, S. Ray, R. Jacob, and L. Vanbever, “A new hope for network model generalization,” inProceedings of the 21st ACM Workshop on Hot Topics in Networks, 2022, pp. 152–159

    2022

  3. [10]

    Attention is all you need,

    A. Vaswani, N. Shazeer, N. Parmar, J. Uszkoreit, L. Jones, A. N. Gomez, Ł. Kaiser, and I. Polosukhin, “Attention is all you need,” Advances in neural information processing systems, vol. 30, 2017

    2017

  4. [11]

    netFound: Foundation Model for Network Security,

    S. Guthula, N. Battula, R. Beltiukov, W. Guo, and A. Gupta, “netFound: Foundation Model for Network Security,”arXiv preprint arXiv:2310.17025, 2023

    2023 arXiv

  5. [12]

    Network intrusion detection based on n-gram frequency and time-aware transformer,

    X. Han, S. Cui, S. Liu, C. Zhang, B. Jiang, and Z. Lu, “Network intrusion detection based on n-gram frequency and time-aware transformer,”Computers & Security, vol. 128, p. 103171, 2023

    2023

  6. [13]

    RTIDS: A robust transformer-based approach for intrusion detection system,

    Z. Wu, H. Zhang, P. Wang, and Z. Sun, “RTIDS: A robust transformer-based approach for intrusion detection system,” IEEE Access, vol. 10, pp. 64 375–64 387, 2022

    2022

  7. [14]

    Flowtransformer: A transformer framework for flow-based network intrusion detection systems,

    L. D. Manocchio, S. Layeghy, W. W. Lo, G. K. Kulatilleke, M. Sarhan, and M. Portmann, “Flowtransformer: A transformer framework for flow-based network intrusion detection systems,” Expert Systems with Applications, vol. 241, p. 122564, 2024

    2024

  8. [15]

    A Method for Network Intrusion Detection Using Flow Sequence and BERT Framework,

    L. G. Nguyen and K. Watabe, “A Method for Network Intrusion Detection Using Flow Sequence and BERT Framework,” in ICC 2023-IEEE International Conference on Communications. IEEE, 2023, pp. 3006–3011

    2023

  9. [16]

    Revolutionizing Cyber Threat Detection with Large Language Models: A privacy-preserving BERT-based Lightweight Model for IoT/IIoT Devices,

    M. A. Ferrag, M. Ndhlovu, N. Tihanyi, L. C. Cordeiro, M. Debbah, T. Lestable, and N. S. Thandi, “Revolutionizing Cyber Threat Detection with Large Language Models: A privacy-preserving BERT-based Lightweight Model for IoT/IIoT Devices,”IEEE Access, 2024

    2024

  10. [17]

    Robust unsupervised network intrusion detection with self-supervised masked context reconstruction,

    W. Wang, S. Jian, Y . Tan, Q. Wu, and C. Huang, “Robust unsupervised network intrusion detection with self-supervised masked context reconstruction,”Computers & Security, vol. 128, p. 103131, 2023

    2023

  11. [18]

    An extreme semi-supervised framework based on transformer for network intrusion detection,

    Y . Li, X. Yuan, and W. Li, “An extreme semi-supervised framework based on transformer for network intrusion detection,” inProceedings of the 31st ACM International Conference on Information & Knowledge Management, 2022, pp. 4204–4208

    2022

  12. [19]

    Et-bert: A contextualized datagram representation with pre-training transformers for encrypted traffic classification,

    X. Lin, G. Xiong, G. Gou, Z. Li, J. Shi, and J. Yu, “Et-bert: A contextualized datagram representation with pre-training transformers for encrypted traffic classification,” inProceedings of the ACM Web Conference 2022, 2022, pp. 633–642

    2022

  13. [20]

    Netgpt: Generative pretrained transformer for network traffic,

    X. Meng, C. Lin, Y . Wang, and Y . Zhang, “Netgpt: Generative pretrained transformer for network traffic,”arXiv preprint arXiv:2304.09513, 2023

    2023 arXiv

  14. [21]

    Mt-flowformer: A semi-supervised flow transformer for encrypted traffic classification,

    R. Zhao, X. Deng, Z. Yan, J. Ma, Z. Xue, and Y . Wang, “Mt-flowformer: A semi-supervised flow transformer for encrypted traffic classification,” inProceedings of the 28th ACM SIGKDD Conference on Knowledge Discovery and Data Mining, 2022, pp. 2576–2584

    2022

  15. [22]

    A neural attention model for real-time network intrusion detection,

    M. Tan, A. Iacovazzi, N.-M. M. Cheung, and Y . Elovici, “A neural attention model for real-time network intrusion detection,” in2019 IEEE 44th conference on local computer networks (LCN). IEEE, 2019, pp. 291–299

    2019

  16. [23]

    FlowFormers: Transformer-based Models for Real-time Network Flow Classification,

    R. Babaria, S. C. Madanapalli, H. Kumar, and V . Sivaraman, “FlowFormers: Transformer-based Models for Real-time Network Flow Classification,” in2021 17th International Conference on Mobility, Sensing and Networking (MSN). IEEE, 2021, pp. 231–238

    2021

  17. [24]

    Real-time Network Intrusion Detection via Decision Transformers,

    J. Chen, H. Zhou, Y . Mei, G. Adam, N. D. Bastian, and T. Lan, “Real-time Network Intrusion Detection via Decision Transformers,”arXiv preprint arXiv:2312.07696, 2023

    2023 arXiv

  18. [26]

    Network Intrusion Detection Model Based on Improved BYOL Self-Supervised Learning,

    Z. Wang, Z. Li, J. Wang, and D. Li, “Network Intrusion Detection Model Based on Improved BYOL Self-Supervised Learning,” Security and Communication Networks, vol. 2021, no. 1, p. 9486949, 2021

    2021

  19. [27]

    Cutmix: Regularization strategy to train strong classifiers with localizable features,

    S. Yun, D. Han, S. J. Oh, S. Chun, J. Choe, and Y . Yoo, “Cutmix: Regularization strategy to train strong classifiers with localizable features,” inProceedings of the IEEE/CVF international conference on computer vision, 2019, pp. 6023–6032

    2019

  20. [28]

    Anomal-E: A self-supervised network intrusion detection system based on graph neural networks,

    E. Caville, W. W. Lo, S. Layeghy, and M. Portmann, “Anomal-E: A self-supervised network intrusion detection system based on graph neural networks,”Knowledge-based systems, vol. 258, p. 110030, 2022

    2022

  21. [29]

    Toward generating a new intrusion detection dataset and intrusion traffic characterization

    I. Sharafaldin, A. H. Lashkari, A. A. Ghorbaniet al., “Toward generating a new intrusion detection dataset and intrusion traffic characterization.”ICISSp, vol. 1, pp. 108–116, 2018

    2018

  22. [30]

    UNSW-NB15: a comprehensive data set for network intrusion detection systems (UNSW-NB15 network data set),

    N. Moustafa and J. Slay, “UNSW-NB15: a comprehensive data set for network intrusion detection systems (UNSW-NB15 network data set),” in2015 military communications and information systems conference (MilCIS). IEEE, 2015, pp. 1–6

    2015

  23. [31]

    Troubleshooting an intrusion detection dataset: the CICIDS2017 case study,

    G. Engelen, V . Rimmer, and W. Joosen, “Troubleshooting an intrusion detection dataset: the CICIDS2017 case study,” in2021 IEEE Security and Privacy Workshops (SPW). IEEE, 2021, pp. 7–12

    2021

  24. [32]

    New directions in automated traffic analysis,

    J. Holland, P. Schmitt, N. Feamster, and P. Mittal, “New directions in automated traffic analysis,” inProceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security, 2021, pp. 3366–3383

    2021

  25. [33]

    Bert: Pre-training of deep bidirectional transformers for language understanding,

    J. Devlin, M.-W. Chang, K. Lee, and K. Toutanova, “Bert: Pre-training of deep bidirectional transformers for language understanding,”arXiv preprint arXiv:1810.04805, 2018

    2018 arXiv

  26. [34]

    Improving language understanding by generative pre-training,

    A. Radford, K. Narasimhan, T. Salimans, I. Sutskeveret al., “Improving language understanding by generative pre-training,” 2018

    2018

  27. [35]

    Error Prevalence in NIDS datasets: A Case Study on CIC-IDS-2017 and CSE-CIC-IDS-2018,

    L. Liu, G. Engelen, T. Lynar, D. Essam, and W. Joosen, “Error Prevalence in NIDS datasets: A Case Study on CIC-IDS-2017 and CSE-CIC-IDS-2018,” in2022 IEEE Conference on Communications and Network Security (CNS). IEEE, 2022, pp. 254–262

    2017

  28. [36]

    An empirical comparison of botnet detection methods,

    S. Garcia, M. Grill, J. Stiborek, and A. Zunino, “An empirical comparison of botnet detection methods,”computers & security, vol. 45, pp. 100–123, 2014

    2014

  29. [37]

    Developing realistic distributed denial of service (DDoS) attack dataset and taxonomy,

    I. Sharafaldin, A. H. Lashkari, S. Hakak, and A. A. Ghorbani, “Developing realistic distributed denial of service (DDoS) attack dataset and taxonomy,” in2019 international carnahan conference on security technology (ICCST). IEEE, 2019, pp. 1–8

    2019

Pith tools

Reviewed August 15, 2026 · model on record in the stance chip above.