Tabular or Image Input? Transformers for NIDS: A Comparative Study
摘要
In recent years, the rapid evolution and complexity of cyber-attacks have made robust intrusion detection systems (IDSs), particularly network-based IDSs (NIDSs), a critical component of cybersecurity infrastructures. Although traditional machine learning (ML) and deep learning (DL) approaches have been widely explored, they often face challenges related to scalability, generalisation, and efficiency. Transformers, originally developed for natural language processing, show a strong ability to face the challenges of ML and DL models. The research that studies applying transformers for detecting intrusions, especially considering their performance on different data representations (tabular vs. image-transformed), is still weak and limited. Therefore, this paper investigates the potential of transformer-based architectures to enhance intrusion detection performance. We conduct a comprehensive evaluation of several transformer models, including TabNet, SAINT-Transformer, FT-Transformer, and Vision Transformer (ViT), across multiple intrusion detection datasets: NSL-KDD, UNSW-NB15, and UNR-IDD. TabNet, SAINT-Transformer, and FT-Transformer are evaluated exclusively on tabular data, while Vision Transformer (ViT) and a lightweight transformer are evaluated on both tabular and image-based representations of network traffic. Image representations for ViT are generated using two methods: single-sample transformation and the sliding window technique. Our experiments assess model performance using accuracy, precision, recall, and F1-score. The results show that tabular transformers perform strongly on datasets with high feature complexity, while ViT with sliding window images excels on datasets with strong temporal dependencies, achieving performance comparable to hybrid models such as CNN+LSTM. These findings provide valuable insights into selecting appropriate transformer architectures and data representations for building efficient and effective NIDS solutions.