Skip to main content
editor.iijri@gmail.com
8007937666
e-ISSN: applied
The Intellecta International Journal of Research and Innovation

The Intellecta International Journal of Research and Innovation

LoginTrack Your Paper
Published

PROTOCOL-STRATIFIED ANOMALY DETECTION OF TCP, UDP AND ICMP ATTACKS WITH A LINEAR-ATTENTION TRANSFORMER: EVIDENCE FROM NSL-KDD AND UNSW-NB15

Published in Oct-Dec 2026 (Vol. 1, Issue 1, 2026)

PROTOCOL-STRATIFIED ANOMALY DETECTION OF TCP, UDP AND ICMP ATTACKS WITH A LINEAR-ATTENTION TRANSFORMER: EVIDENCE FROM NSL-KDD AND UNSW-NB15 - Issue cover

Keywords

Anomaly detectionIntrusion detection systemLinformerProtocol-stratified evaluationNSL-KDDUNSW-NB15

Abstract

In general, studies of intrusion detection report only one accuracy or F1 score calculated on the entire test set. Since TCP, UDP and ICMP toxicate attack traf ic in very dif erent ratios, an average such a figure overprofiles problems of varying dif iculty and may mask a detector that collapses on a complete protocol. We introduce a protocol-aware anomaly detector, based on the Linformer, a variation of transformer that scales its attention cost linearly with the input length, and we rank it on each protocol on two benchmark corpora. On NSL-KDD (148,517 records) and UNSW-NB15 (215,757 records after protocol filtering), six experiments are done on a fully crossed design comparing the Linformer with a Decision Tree and a random forest that has 72,856 held-out records. On NSL-KDD the Linformer reached an accuracy of 0.9823, an F1-score of 0.9816 and an AUC-ROC of 0.9987; on UNSW-NB15 the corresponding values were 0.9231, 0.9344 and 0.9832. Breaking down the results according to protocol revealed a bug that the cumulative figures disguised: only 3.61 percent of the ICMP attacks were identified by the Random Forest, which has a cumulative accuracy of 0.8784 on NSL-KDD, compared to 99.30 percent by the Linformer. The protocol subsets (among five that are assessable) F1 increased with attack prevalence (Pearson = 0.7773), indicating that a direct solution is per-protocol threshold calibration. Extrapolating the measured error rates onto the prevalence values determined that accuracy reduces to 0.3415 at 1% attack traf ic, indicating the detector should not be used as a blocker, despite the fact that at 0.9793, the prevalence matches the benchmark prevalence criterion.

References

  1. [1]Aggarwal P, Sharma SK (2015) Analysis of KDD dataset attributes: class wise for intrusion detection. Procedia Computer Science 57:842–851.
  2. [2]Alkhater N (2026) A rigorous comparative study of supervised machine learning techniques for network anomaly detection: empirical insights from the UNSW NB15 dataset. Computers 15(5):285. https://doi.org/10.3390/computers15050285
  3. [3]Axelsson S (2000) The base rate fallacy and the difficulty of intrusion detection. ACM Transactions on Information and System Security 3(3):186–205.
  4. [4]Aygun RC, Yavuz AG (2017) Network anomaly detection with stochastically improved autoencoder based models. In: 2017 IEEE 4th International Conference on Cyber Security and Cloud Computing (CSCloud). IEEE, pp 193–198.
  5. [5]Ba JL, Kiros JR, Hinton GE (2016) Layer normalization. arXiv preprint arXiv:1607.06450.
  6. [6]Bace R, Mell P (2001) Intrusion Detection Systems. NIST Special Publication 800 31. National Institute of Standards and Technology, Gaithersburg.
  7. [7]Berglund M, Raiko T (2013) Stochastic gradient estimate variance in contrastive divergence and persistent contrastive divergence. arXiv preprint arXiv:1312.6002.
  8. [8]Breiman L (2001) Random forests. Machine Learning 45(1):5–32.
  9. [9]Breiman L, Friedman JH, Olshen RA, Stone CJ (1984) Classification and Regression Trees. Wadsworth and Brooks, Monterey.
  10. [10]Buczak AL, Guven E (2016) A survey of data mining and machine learning methods for cyber security intrusion detection. IEEE Communications Surveys & Tutorials 18(2):1153–1176.
  11. [11]Chicco D, Jurman G (2020) The advantages of the Matthews correlation coefficient (MCC) over F1 score and accuracy in binary classification evaluation. BMC Genomics 21(1):6.
  12. [12]Chinnasamy R, Subramanian M, Veerappampalayam Easwaramoorthy S, Cho J (2025) Deep learning driven methods for network based intrusion detection systems: a systematic review. ICT Express 11(1):181–215. https://doi.org/10.1016/j.icte.2025.01.005
  13. [13]Denning DE (1987) An intrusion detection model. IEEE Transactions on Software Engineering SE 13(2):222–232.
  14. [14]Farhan M, Waheed ud din H, Ullah S et al. (2025) Network based intrusion detection using deep learning technique. Scientific Reports 15:25550. https://doi.org/10.1038/s41598-025-08770-0
  15. [15]Fawcett T (2006) An introduction to ROC analysis. Pattern Recognition Letters 27(8):861–874.
  16. [16]Fischer A, Igel C (2012) An introduction to restricted Boltzmann machines. In: Progress in Pattern Recognition, Image Analysis, Computer Vision, and Applications. Springer, Berlin, pp 14–36.
  17. [17]Hendrycks D, Gimpel K (2016) Gaussian error linear units (GELUs). arXiv preprint arXiv:1606.08415.
  18. [18]Hinton GE (2009) Deep belief networks. Scholarpedia 4(5):5947.
  19. [19]Ioffe S, Szegedy C (2015) Batch normalization: accelerating deep network training by reducing internal covariate shift. In: Proceedings of the 32nd International Conference on Machine Learning, pp 448–456.
  20. [20]Jeong J, Park S, Lim J, Kang J, Shin D, Shin D (2024) A study on network anomaly detection using fast persistent contrastive divergence. Symmetry 16(9):1220. https://doi.org/10.3390/sym16091220
  21. [21]Khan FA, Gumaei A (2019) A comparative study of machine learning classifiers for network intrusion detection. In: Artificial Intelligence and Security: 5th International Conference, ICAIS 2019. Springer, pp 75–86.
  22. [22]Kingma DP, Ba J (2015) Adam: a method for stochastic optimization. In: Proceedings of the 3rd International Conference on Learning Representations.
  23. [23]Liao HJ, Lin CHR, Lin YC, Tung KY (2013) Intrusion detection system: a comprehensive review. Journal of Network and Computer Applications 36(1):16–24.
  24. [24]Malaiya RK, Kwon D, Suh SC, Kim H, Kim I, Kim J (2019) An empirical evaluation of deep learning for network anomaly detection. IEEE Access 7:140806–140817.
  25. [25]Min B, Yoo J, Kim S, Shin D, Shin D (2021) Network anomaly detection using memory augmented deep autoencoder. IEEE Access 9:104695–104706.
  26. [26]Moustafa N, Slay J (2015) UNSW NB15: a comprehensive data set for network intrusion detection systems. In: 2015 Military Communications and Information Systems Conference (MilCIS). IEEE, pp 1–6.
  27. [27]Moustafa N, Slay J (2016) The evaluation of network anomaly detection systems: statistical analysis of the UNSW NB15 data set and the comparison with the KDD99 data set. Information Security Journal: A Global Perspective 25(1–3):18–31.
  28. [28]Naseer S, Saleem Y, Khalid S, Bashir MK, Han J, Iqbal MM, Han K (2018) Enhanced network anomaly detection based on deep neural networks. IEEE Access 6:48231–48246.
  29. [29]Pang G, Shen C, Cao L, van den Hengel A (2021) Deep learning for anomaly detection: a review. ACM Computing Surveys 54(2):38.
  30. [30]Paszke A, Gross S, Massa F et al. (2019) PyTorch: an imperative style, high performance deep learning library. Advances in Neural Information Processing Systems 32:8024–8035.
  31. [31]Pedregosa F, Varoquaux G, Gramfort A et al. (2011) Scikit learn: machine learning in Python. Journal of Machine Learning Research 12:2825–2830.
  32. [32]Pinto Neto EC, Iqbal S, Buffett S et al. (2025) Deep learning for intrusion detection in emerging technologies: a comprehensive survey and new perspectives. Artificial Intelligence Review 58(11):340. https://doi.org/10.1007/s10462-025-11346-z
  33. [33]Powers DMW (2011) Evaluation: from precision, recall and F measure to ROC, informedness, markedness and correlation. Journal of Machine Learning Technologies 2(1):37–63.
  34. [34]Ribeiro MT, Singh S, Guestrin C (2016) “Why should I trust you?”: explaining the predictions of any classifier. In: Proceedings of the 22nd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining. ACM, pp 1135–1144.
  35. [35]Ring M, Wunderlich S, Scheuring D, Landes D, Hotho A (2019) A survey of network based intrusion detection data sets. Computers & Security 86:147–167.
  36. [36]Sommer R, Paxson V (2010) Outside the closed world: on using machine learning for network intrusion detection. In: Proceedings of the IEEE Symposium on Security and Privacy, pp 305–316.
  37. [37]Srivastava N, Hinton G, Krizhevsky A, Sutskever I, Salakhutdinov R (2014) Dropout: a simple way to prevent neural networks from overfitting. Journal of Machine Learning Research 15(1):1929–1958.
  38. [38]Tang TA, Mhamdi L, McLernon D, Zaidi SAR, Ghogho M (2016) Deep learning approach for network intrusion detection in software defined networking. In: 2016 International Conference on Wireless Networks and Mobile Communications (WINCOM). IEEE, pp 258–263.
  39. [39]Tavallaee M, Bagheri E, Lu W, Ghorbani AA (2009) A detailed analysis of the KDD CUP 99 data set. In: 2009 IEEE Symposium on Computational Intelligence for Security and Defense Applications. IEEE, pp 1–6.
  40. [40]Tieleman T, Hinton G (2009) Using fast weights to improve persistent contrastive divergence. In: Proceedings of the 26th Annual International Conference on Machine Learning. ACM, pp 1033–1040.
  41. [41]Umer M, Tahir M, Sardaraz M et al. (2025) Network intrusion detection model using wrapper based feature selection and multi head attention transformers. Scientific Reports 15:28718. https://doi.org/10.1038/s41598-025-11348-5
  42. [42]Vaswani A, Shazeer N, Parmar N, Uszkoreit J, Jones L, Gomez AN, Kaiser Ł, Polosukhin I (2017) Attention is all you need. Advances in Neural Information Processing Systems 30:5998–6008.
  43. [43]Wang S, Li BZ, Khabsa M, Fang H, Ma H (2020) Linformer: self attention with linear complexity. arXiv preprint arXiv:2006.04768.
  44. [44]Xi C, Wang H, Wang X (2024) A novel multi scale network intrusion detection model with transformer. Scientific Reports 14:23239. https://doi.org/10.1038/s41598-024-74214-w
  45. [45]Xu J, Wu H, Wang J, Long M (2022) Anomaly Transformer: time series anomaly detection with association discrepancy. In: Proceedings of the International Conference on Learning Representations.
  46. [46]Yin C, Zhu Y, Fei J, He X (2017) A deep learning approach for intrusion detection using recurrent neural networks. IEEE Access 5:21954–21961.
  47. [47]Zhou X, Hu Y, Liang W, Ma J, Jin Q (2020) Variational LSTM enhanced anomaly detection for industrial big data. IEEE Transactions on Industrial Informatics 17:3469–3477.

Authors (1)

Archana

Department of Computer Science...

View all publications →

Download Article

PDF

Best for printing and citation

File size: 1.5 MB
Format: PDF
ViewDownload

Article Information

Published in:

Oct-Dec 2026 (Vol. 1, Issue 1, 2026)

IIJRI110005

IIJRI-01-000009

45-61

2026-10-10

JATS XML

Article Impact

Views:32
Downloads:24

How to Cite

Archana (2026). PROTOCOL-STRATIFIED ANOMALY DETECTION OF TCP, UDP AND ICMP ATTACKS WITH A LINEAR-ATTENTION TRANSFORMER: EVIDENCE FROM NSL-KDD AND UNSW-NB15. The Intellecta International Journal of Research and Innovation, 1(1), 45-61. https://iijri.a1advancepublications.com/articles/IIJRI110005

Article Actions

Whatsapp