Pith. sign in

REVIEW 5 major objections 4 minor 16 references

Time Series Based Network Intrusion Detection using MTF-Aided Transformer

T0 review · 5 major / 4 minor · reviewed 2026-08-05 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Representing SDN traffic as transition matrices lets a Transformer hold 98% F1 with 40% data missing

desk verdict Reasonable architecture, but test-set tuning of tau and missing error bars make the headline performance claims uninterpretable; worth a revision, not a desk reject. read the letter →

arxiv 2508.16035 v1 pith:LWDB3H73 submitted 2025-08-22 cs.NI cs.AI

Poorvi Joshi , Mohan Gurusamy (National University of Singapore) This is my paper · ORCID
classification cs.NIcs.AI
keywords MarkovTransitionFieldTransformerintrusiondetectionsoftware-definednetworkingtimeseriesclassificationsparsedataInSDNdatasetself-attention
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper claims that converting each network link's traffic time series into a Markov Transition Field (MTF)—a matrix of learned transition probabilities between quantized traffic states—and feeding those fields through a two-level Transformer that also reads a static source-destination connectivity matrix yields a multi-class intrusion detector for software-defined networks. Evaluated on the InSDN dataset, the proposed MTF-aided Transformer is reported to consistently outperform KNN, Random Forest, LSTM, and Donut, with the largest margin under 60% data accessibility (F1 98.0% vs 83.5% for Donut) and 50.76% faster detection on average. An ablation study shows that removing either the MTF encoding or the Transformer drops F1 by roughly 5 to 7 points, supporting the claim that the two components work together. If correct, this gives SDN operators a representation-and-architecture recipe that degrades gracefully when flow telemetry is incomplete.

What carries the argument

The key objects are the Markov Transition Field (MTF) and the two-level stacked Transformer. For each feature's time series, adaptive quantization learns bin boundaries via backpropagation, and a Q x Q transition matrix records probabilities of moving from one quantized state to the next; the MTF extends this to all time pairs and is downsampled with Gaussian blurring. The first Transformer layer computes self-attention over each feature's MTF separately, producing context vectors; the second layer concatenates those contexts with the flattened spatial matrix St (a one-hot protocol-aware connectivity tensor) and applies self-attention again, ending in a softmax classifier. The MTF supplies t

What would settle it

Run the same experiment with nested cross-validation: select tau and any hyperparameters only on training folds, then evaluate on held-out folds. If the proposed model's F1 at 60% data accessibility drops below roughly 90% or no longer exceeds Donut by a wide margin, the claimed sparse-data superiority is not supported.

Watch

Extended reading notes

Core claim

The central claim is that the MTF-aided Transformer delivers superior multi-class intrusion detection on SDN traffic compared to KNN, Random Forest, LSTM, and Donut, particularly when data is scarce. The paper argues the gain comes from the combination of the MTF's probabilistic transition encoding, which captures how traffic moves between quantized states over time, and the Transformer's self-attention, which catches long-range dependencies without sequential processing. A second Transformer level fuses per-feature context with a spatial matrix S_t (N x N x 2) encoding source-destination connectivity and protocol type, giving the model link-level structural awareness. The reported numbers a

Load-bearing premise

The evaluation protocol chooses the time-slot duration tau by scanning precision on the test data, with a single 80-20 train/test split and no separate validation set, so the reported margins over baselines could reflect test-set tuning rather than a genuine advantage.

Editorial extensions

If this is right

  • SDN controllers could run per-link intrusion detection in near real time: the reported 8 ms inference time is low enough for flow-slot-level screening.
  • The graceful degradation at 60% data accessibility implies the method tolerates packet capture loss or incomplete flow records without collapsing to chance-level accuracy.
  • The recipe—adaptive quantization to a transition field, then hierarchical self-attention with a structural side-input—is portable to other multivariate time-series classification settings such as sensor or log anomaly detection.
  • The ablation results imply that neither the temporal encoding nor the attention architecture alone accounts for the gain; both are needed, guiding future design choices.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • A true test of the claimed data-scarcity advantage would require nested cross-validation where the time-slot duration tau is selected on training folds only; the paper's single-split protocol with tau chosen after scanning precision leaves the margin's size unverified.
  • The spatial matrix St is assumed static within each tau; in real SDNs with frequent topology changes, the benefit may shrink—an extension would be to make St time-varying.
  • Because the baselines are classical or recurrent models, the comparison does not include other recent time-series Transformers or image-based detectors; the MTF-specific contribution would be isolated by ablating the quantization method against fixed Gaussian binning.
  • The reported training time likely reflects the InSDN subset size; scaling to larger networks would need the MTF's O(T^2) construction to be approximated.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

5 major / 4 minor

Summary. The paper proposes an MTF-aided stacked Transformer for multi-class network intrusion detection in SDN environments. Link-level time series are converted into Markov Transition Fields, and a source-destination/protocol spatial matrix is integrated via a second Transformer encoder. The method is evaluated on the InSDN dataset under 100%, 80%, and 60% data accessibility, reporting consistent gains in precision, recall, and F1 over KNN, Random Forest, LSTM, and Donut, plus faster inference and an ablation study showing both MTF and Transformer components matter.

Significance. If the empirical claims were properly supported, the work would be a useful contribution: combining MTF-based temporal encoding with a hierarchical Transformer for SDN traffic is a sensible idea, the use of a public dataset (InSDN) is appropriate, and the ablation attempt is in the right direction. The paper also provides algorithmic pseudocode that improves reproducibility. However, the current evaluation protocol—single-run results, test-set-based hyperparameter selection, and underspecified baselines—means the central outperformance claim is not established. The architectural description also contains inconsistencies that would need correction before the method could be independently reproduced.

major comments (5)
  1. [Section III, Fig. 3 and Table II] The time-slot duration τ is selected by scanning precision over values 1–20 times the minimum flow duration, and the dataset is split only into training and testing (80–20). If the precision curve in Fig. 3 is computed on the same test split as Table II, then τ is effectively tuned on the test data. This selection bias can inflate the reported F1/precision and makes the claimed margins over KNN/RF/LSTM/Donut (e.g., 98.0 vs 83.5 F1 at 60% accessibility) uninterpretable. In addition, all results appear to come from a single run, with no standard deviations or error bars, and the 'random removal' simulation is not specified with seeds or repeats. The authors need to use a separate validation set or nested cross-validation for τ selection, report mean±std over multiple runs with different seeds, and provide the exact data-loss simulation procedure.
  2. [Section II-A, Eq. (4) and Algorithm 1] There is an internal inconsistency in the definition of the Markov transition probabilities. Eq. (4) defines P(q_i|q_j) with denominator Σ_{j=1}^Q count(x_k ∈ q_j), which is not a row normalization and does not correspond to a conditional probability given state q_j. Algorithm 1 (lines 11 and 17) explicitly says 'Normalize W_l by rows' and 'Normalize M_{t,l} by rows,' which conflicts with Eq. (4). The correct denominator for a conditional probability is count(x_k ∈ q_j). This discrepancy affects the core MTF construction and must be resolved.
  3. [Section II-B.1, Eq. (7)–(9)] The embedding dimension of each MTF matrix is stated as '(τ/Q)×1', where τ is the time series length and Q is the number of quantization bins. This is not justified by the preceding description: after Gaussian blurring, the dimensions of M_{t,l} are never specified, and τ/Q has units of time per bin, not a vector length. The notation also makes it unclear whether the MTF is flattened, downsampled, or projected. Since this dimension is central to the Transformer input, the paper needs a precise definition of the MTF matrix size before and after dimensionality reduction, and of how the (τ/Q)×1 embedding is obtained.
  4. [Section III, Tables II and III] The baseline models are not described in enough detail to make the comparison meaningful. For KNN, Random Forest, LSTM, and Donut, the paper does not state the input representation (raw time series? MTF? aggregated features?), hyperparameters, training procedure, or whether they were tuned by the same protocol. Without this information, the 'consistent outperformance' claim in Table II and the timing comparison in Table III cannot be independently assessed. The authors should specify baseline implementations, hyperparameters, and the exact input features fed to each baseline.
  5. [Section III, Table IV] The ablation study reports a single set of numbers with no variance, and the 'Without Transformer' variant is described only as 'a simpler feedforward network' without architecture details. Given that the main contribution depends on showing both components are necessary, the ablation should include at least repeated runs and a precise description of the feedforward replacement.
minor comments (4)
  1. [Abstract/Introduction] The phrase 'up to 26.5% higher classification performance' is not tied to a specific metric in the abstract or introduction. In Table II, the largest F1 gap at 60% accessibility is 98.0 vs 83.5 (14.5 percentage points), while the largest precision gap is 98.3 vs 72.4 (25.9 percentage points). The claim should be made metric-specific and derived from the table.
  2. [Section II, system architecture] The spatial matrix is described as one-hot encoding protocols with '00 indicates no flow, 01 TCP, 10 UDP.' This leaves the 11 combination undefined; please clarify what value is used when multiple protocols are present or if 11 is never used.
  3. [Section III and Table I] The hyperparameter table lists learning rate, batch size, and network widths, but does not include the key values for τ, Q, the Gaussian blur kernel size/σ, or the number of Transformer encoder layers. Since these are central to the model, they should be included in Table I.
  4. [Section III, data split] The paper says the dataset is split 80-20 but does not report the class distribution of the split or whether the split is stratified. This matters for multi-class intrusion detection with imbalanced attack categories.

Circularity Check

1 steps flagged · score 6.0 of 10

τ is selected using the test-set precision curve and then the same test set is used to report the final precision/F1, so the claimed performance margins are partially fitted rather than predicted.

  1. fitted input called prediction [Section III, 'Effect of Timeslot Duration on Precision' (Fig. 3) and evaluation setup]
    "One important parameter in our model is τ, which represents the time slot duration and plays a crucial role in determining precision. ... Through extensive experimentation, we observed that setting τ between 4 and 7 times the minimum flow duration provides stable performance across different runs. Based on these findings, we selected τ=5 times the minimum flow duration for our final model. Fig. 3 presents how precision varies as τ changes from 1 to 20 times the minimum flow duration. ... We split the dataset into training and testing subsets using a standard 80-20 split."

    The paper describes only an 80-20 train/test split; no validation set or cross-validation is mentioned. The time-slot duration τ is chosen by scanning the precision curve in Fig. 3 and selecting the value labeled 'Optimal τ = 5'. If that precision curve is computed on the same test split later used for Table II, then τ is effectively fit to the test data on the exact metric (precision) that is then reported as the model's predicted performance. The reported F1/precision for the proposed model is therefore not an unbiased prediction but a fitted value, and the claimed margins over KNN, Random Forest, LSTM, and Donut are partially forced by construction of the evaluation protocol.

full rationale

The paper is an empirical evaluation on the external InSDN dataset; it makes no first-principles derivation, and there are no load-bearing self-citations. The MTF representation, the Transformer architecture, and the spatial matrix are all learned or constructed from the input data and are not circular in themselves. The only substantive circularity is in the evaluation protocol: τ is selected using a precision scan (Fig. 3) without a separate validation set, and then the same test split is used to report final precision/F1 (Table II). This means the proposed model's reported performance is partly a fitted quantity, undermining the claimed outperformance margins. Because the central comparison is affected, but the architecture itself has independent content, the circularity score is moderate rather than extreme.

Assumptions & free parameters 3 free parameters · 4 assumptions · 0 invented entities

The model's contribution is empirical. Its central claim rests on learned model parameters, the chosen time-slot duration tau, the quantization bin count Q, the blur kernel sigma, and the assumptions that SDN topology is static within a slot, that MTF transitions carry discriminative signal, and that InSDN is a representative benchmark. No new entities are postulated. The main free parameter of concern is tau, which appears to be selected on the test set.

free parameters (3)
  • tau (time slot duration) = 5 x minimum flow duration
    Selected by scanning precision across tau = 1...20 on InSDN (Fig. 3); no separate validation set described, so reported performance can be optimistic.
  • Q (number of quantization bins) = not reported
    Number of MTF states determines representation size and transition resolution; not specified anywhere.
  • sigma (Gaussian blur kernel width) = not reported
    Gaussian blur is used for MTF dimensionality reduction (Eq. 6), but sigma is not given.
assumptions (4)
  • domain assumption The network topology S_t remains fixed within each time slot of duration tau.
    Stated in Sec. II: 'The spatial matrix remains fixed within each tau duration, assuming no significant topology changes in short intervals.' This determines the spatial input to the second Transformer.
  • domain assumption The InSDN dataset provides representative SDN traffic and attack classes for the claimed benchmark.
    All evaluation uses InSDN [12] only; generalization to other SDN environments is assumed.
  • domain assumption Markov transition probabilities between quantized traffic states preserve enough temporal structure for attack classification.
    Core motivation for MTF encoding; not verified outside the reported dataset, and the transition-count equation (Eq. 4) has a normalization typo.
  • domain assumption Gaussian blurring reduces MTF size while preserving critical transition patterns.
    Eq. 6 used for dimensionality reduction; no analysis of information loss.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Time Series Based Network Intrusion Detection using MTF-Aided Transformer." pith.science (2026). https://pith.science/paper/LWDB3H73

@misc{pith2026250816035,
  author       = {Pith},
  title        = {Pith review of: Time Series Based Network Intrusion Detection using MTF-Aided Transformer},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/LWDB3H73}},
  note         = {Machine review of arXiv:2508.16035}
}
read the original abstract

This paper introduces a novel approach to time series classification using a Markov Transition Field (MTF)-aided Transformer model, specifically designed for Software-Defined Networks (SDNs). The proposed model integrates the temporal dependency modeling strengths of MTFs with the sophisticated pattern recognition capabilities of Transformer architectures. We evaluate the model's performance using the InSDN dataset, demonstrating that our model outperforms baseline classification models, particularly in data-constrained environments commonly encountered in SDN applications. We also highlight the relationship between the MTF and Transformer components, which leads to better performance, even with limited data. Furthermore, our approach achieves competitive training and inference times, making it an efficient solution for real-world SDN applications. These findings establish the potential of MTF-aided Transformers to address the challenges of time series classification in SDNs, offering a promising path for reliable and scalable analysis in scenarios with sparse data.

Figures

Figures reproduced from arXiv: 2508.16035 by the authors.

Figure 1
Figure 1. System Architecture attention mechanisms [8]. However, each of the above approaches comes with its own set of challenges. RNN-based models are often computationally inefficient due to their sequential nature, which makes them less suitable for large-scale time-series data. CNNs typically require transforming sequential data into images, which can result in a loss of contextual integrity. While TCNs offer improvement… view at source ↗
Figure 2
Figure 2. Stacked Transformer Architecture 𝐶𝑡 = 𝐴𝑠𝑉𝑠 (20) where 𝑊′ 𝑄 , 𝑊′ 𝐾 , 𝑊′ 𝑉 are weight matrices and 𝑏 ′ 𝑄 , 𝑏 ′ 𝐾 , 𝑏 ′ 𝑉 are bias vectors. 𝐶𝑡 is the final contextualized representation. The final context vector 𝐶𝑡 is passed through a fully connected layer followed by a softmax function for multi-class classification: 𝑌𝑡 = softmax(𝑊𝑜𝐶𝑡 + 𝑏𝑜) (21) where 𝑊𝑜 is the output weight matrix and 𝑏𝑜 is the output bias. 𝑌𝑡 repres… view at source ↗
Figure 3
Figure 3. Precision variation with respect to 𝜏 We compare our model with traditional classification models such as k-Nearest Neighbors (KNN) [13], Random Forest [14], LSTM [15], and Donut [16] for multi-class classification. These models aggregate time-series data for further processing. We evaluate them under different levels of data accessibility: 100%, 80%, and 60%. Our model consistently outperforms others, especially wh… view at source ↗

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

16 extracted references · 14 canonical work pages

  1. [1]

    Software-defined networking: A comprehensive survey,

    D. Kreutz, F. M. Ramos, P. E. Verissimo, C. E. Rothenberg, S. Azodol- molky, and S. Uhlig, “Software-defined networking: A comprehensive survey,”Proceedings of the IEEE , vol. 103, no. 1, pp. 14–76, 2014

    work page 2014

  2. [2]

    Sdn security review: Threat taxonomy, implications, and open challenges,

    M. Rahouti, K. Xiong, Y. Xin, S. K. Jagatheesaperumal, M. Ayyash, and M. Shaheed, “Sdn security review: Threat taxonomy, implications, and open challenges,” IEEE Access , vol. 10, pp. 45 820–45 854, 2022

    work page 2022

  3. [3]

    An enhanced resilient backpropagation artificial neural network for intrusion detection system,

    R. S. Naoum, N. A. Abid, and Z. N. Al-Sultani, “An enhanced resilient backpropagation artificial neural network for intrusion detection system,” International Journal of Computer Science and Network Security (IJC- SNS), vol. 12, no. 3, p. 11, 2012

    work page 2012

  4. [4]

    Enhanced network intrusion detection using deep convolutional neural networks,

    S. Naseer and Y. Saleem, “Enhanced network intrusion detection using deep convolutional neural networks,” KSII Transactions on Internet and Information Systems (TIIS) , vol. 12, no. 10, pp. 5159–5178, 2018

    work page 2018

  5. [5]

    Network intrusion detection via flow-to-image conversion and vision transformer classification,

    C. M. K. Ho, K.-C. Yow, Z. Zhu, and S. Aravamuthan, “Network intrusion detection via flow-to-image conversion and vision transformer classification,” IEEE Access , vol. 10, pp. 97 780–97 793, 2022

    work page 2022

  6. [6]

    A convolutional neural network for improved anomaly-based network intrusion detection,

    I. Al-Turaiki and N. Altwaijry, “A convolutional neural network for improved anomaly-based network intrusion detection,” Big Data , vol. 9, no. 3, pp. 233–252, 2021

    work page 2021

  7. [7]

    A novel approach for network intrusion detection using multistage deep learning image recognition,

    J. Toldinas, A. Ven ˇckauskas, R. Dama ˇseviˇcius, ˇS. Grigali¯ unas, N. Morkevi ˇcius, and E. Baranauskas, “A novel approach for network intrusion detection using multistage deep learning image recognition,” Electronics, vol. 10, no. 15, p. 1854, 2021

    work page 2021

  8. [8]

    Deep learning for anomaly detection in time-series data: Review, analysis, and guidelines,

    K. Choi, J. Yi, C. Park, and S. Yoon, “Deep learning for anomaly detection in time-series data: Review, analysis, and guidelines,”IEEE access, vol. 9, pp. 120 043–120 065, 2021

    work page 2021

Show all 16 references
  1. [9]

    Time series anomaly detection using convolutional neural networks and transfer learning,

    T. Wen and R. Keyes, “Time series anomaly detection using convolutional neural networks and transfer learning,”arXiv preprint arXiv:1905.13628 , 2019

    1905 arXiv

  2. [10]

    An empirical evaluation of generic convolutional and recurrent networks for sequence modeling,

    S. Bai, J. Z. Kolter, and V. Koltun, “An empirical evaluation of generic convolutional and recurrent networks for sequence modeling,” arXiv preprint arXiv:1803.01271, 2018

    2018 arXiv

  3. [11]

    An attention- based convlstm autoencoder with dynamic thresholding for unsupervised anomaly detection in multivariate time series,

    T. Tayeh, S. Aburakhia, R. Myers, and A. Shami, “An attention- based convlstm autoencoder with dynamic thresholding for unsupervised anomaly detection in multivariate time series,” Machine Learning and Knowledge Extraction, vol. 4, no. 2, pp. 350–370, 2022

    2022

  4. [12]

    Insdn: A novel sdn intrusion dataset,

    M. S. Elsayed, N.-A. Le-Khac, and A. D. Jurcut, “Insdn: A novel sdn intrusion dataset,” IEEE access , vol. 8, pp. 165 263–165 284, 2020

    2020

  5. [13]

    Efficient knn classi- fication with different numbers of nearest neighbors,

    S. Zhang, X. Li, M. Zong, X. Zhu, and R. Wang, “Efficient knn classi- fication with different numbers of nearest neighbors,” IEEE transactions on neural networks and learning systems , vol. 29, no. 5, pp. 1774–1785, 2017

    2017

  6. [14]

    Random forest in remote sensing: A review of applications and future directions,

    M. Belgiu and L. Dr ˘agut ¸, “Random forest in remote sensing: A review of applications and future directions,” ISPRS journal of photogrammetry and remote sensing , vol. 114, pp. 24–31, 2016

    2016

  7. [15]

    Network anomaly detection using lstm based autoencoder,

    M. Said Elsayed, N.-A. Le-Khac, S. Dev, and A. D. Jurcut, “Network anomaly detection using lstm based autoencoder,” in Proceedings of the 16th ACM Symposium on QoS and Security for Wireless and Mobile Networks, 2020, pp. 37–45

    2020

  8. [16]

    Unsupervised anomaly detection via variational auto-encoder for seasonal kpis in web applications,

    H. Xu, W. Chen, N. Zhao, Z. Li, J. Bu, Z. Li, Y. Liu, Y. Zhao, D. Pei, Y. Feng et al. , “Unsupervised anomaly detection via variational auto-encoder for seasonal kpis in web applications,” inProceedings of the 2018 world wide web conference, 2018, pp. 187–196

    2018

Pith tools

Reviewed August 5, 2026 · model on record in the stance chip above.