Aghawafaabbass/AegisFormer-IDS

A lightweight FT-Transformer–based Intrusion Detection System for real-time network traffic classification using the NSL-KDD dataset. Achieves >99% accuracy and F1-score with fast inference and low resource consumption # AegisFormer-IDS: Fast FT-Transformer for Real-Time Intrusion Detection on NSL-KDD ## Citation & Publication This project accompanies the published research paper: **Agha, W. A.** (2025). *AegisFormer-IDS: Fast FT-Transformer for Real-Time Intrusion Detection on NSL-KDD*. Zenodo. 🔗 doi.org ## Abstract In the event of insecurity of network infrastructures due to cyber attacks, real-time intrusion detection systems (IDS) play a critical role in ensuring protection to these network infrastructures. This paper describes AegisFormer-IDS, a lightweight, feature-efficient Feature-Tokenized Transformer (FT-Transformer) network that is best used to perform a fast binary classification of network traffic as either normal or anomalous. Our work (based on the NSL-KDD dataset) embraces best practices such as the label encoding of categorical features, the standardization of numerical features, and binary re-labeling (normal vs. attack) to facilitate movement to a simplified Transformer encoder architecture. The architecture is very compact, with projection of features, multi-head self-attention layers, and a fully connected classification head that allows quick inference without compromising performance. AegisFormer-IDS, trained on 10 epochs with the PyTorch framework, Adam optimization, cross-entropy loss, and a learning rate scheduler, achieves validation accuracy over 99% and F1-score above 0.99 on an 80/20 train/validation split. Empirical evidence shows that it is better in speed, accuracy, and resource consumption than standard deep learning models, and can be deployed in real-time where resource constraints are present. The gap between transformer-based progress and scalable high-fidelity network security utilization is bridged in this work, leading to scalable applications of network security. ## Keywords Intrusion Detection System (IDS), FT-Transformer, NSL-KDD Dataset, Real-Time Network Security, Deep Learning, Binary Classif …