ThreatFormer-IDS: Robust Transformer Intrusion Detection with Zero-Day Generalization and Explainable Attribution

Srikumar Nayak

cs.CRFeb 26, 2026

ThreatFormer-IDS: Robust Transformer Intrusion Detection with Zero-Day Generalization and Explainable Attribution

Authors: Srikumar Nayak

Organizations: Incedo Inc, USA

Abstract

Intrusion detection in IoT and industrial networks requires models that can detect rare attacks at low false-positive rates while remaining reliable under evolving traffic and limited labels. Existing IDS solutions often report strong in-distribution accuracy, but they may degrade when evaluated on future traffic, unseen (zero-day) attack families, or adversarial feature manipulations, and many systems provide limited evidence to support analyst triage. To address these gaps, we propose ThreatFormer- IDS, a Transformer-based sequence modeling framework that converts flow records into time-ordered windows and learns contextual representations for robust intrusion screening. The method combines (i) weighted supervised learning for imbalanced detection, (ii) masked self-supervised learning to improve representation stability under drift and sparse labels, (iii) PGDbased adversarial training with scale-normalized perturbations to strengthen resilience against feature-level evasion, and (iv) Integrated Gradients attribution to highlight influential time steps and features for each alert. On the ToN IoT benchmark with chronological evaluation, ThreatFormer-IDS achieves AUCROC 0.994, AUC-PR 0.956, and Recall@1%FPR 0.910, outperforming strong tree-based and sequence baselines. Under a zero-day protocol with held-out attack families, it maintains superior generalization (AUC-PR 0.721, Recall@1%FPR 0.783). Robustness tests further show slower degradation in AUCPR as the adversarial budget increases, confirming improved stability under bounded perturbations. Overall, ThreatFormer- IDS provides a unified, deployment-oriented IDS pipeline that balances detection quality, zero-day behavior, robustness, and explainability.

Figures & tables

Panel of Figure 1 — Fig. 1: ThreatFormer-IDS pipeline: IoT flows are preprocessed and converted into time-ordered sequences, encoded by a Transformer, and scored for low-FPR intrusion screening; training is strengthened using masked self-supervision, PGD-based adversarial defense, and zero-day evaluation, while Integrated Gradients provides attribution for analyst review.

Model	AUC-ROC $\uparrow$	AUC-PR $\uparrow$	Recall@1%FPR $\uparrow$	F1 $\uparrow$	FPR@95%TPR $\downarrow$	Latency (ms/seq) $\downarrow$
Logistic Regression [ 1 ]	0.941 $\pm$ 0.002	0.821 $\pm$ 0.003	0.744 $\pm$ 0.006	0.912 $\pm$ 0.004	1.620 $\pm$ 0.003	0.28 $\pm$ 0.05
Random Forest [ 11 ]	0.972 $\pm$ 0.002	0.901 $\pm$ 0.003	0.831 $\pm$ 0.006	0.944 $\pm$ 0.004	0.980 $\pm$ 0.003	1.80 $\pm$ 0.05
XGBoost [ 6 ]	0.982 $\pm$ 0.002	0.921 $\pm$ 0.003	0.856 $\pm$ 0.006	0.955 $\pm$ 0.004	0.740 $\pm$ 0.003	1.25 $\pm$ 0.05
LightGBM [ 5 ]	0.983 $\pm$ 0.002	0.926 $\pm$ 0.003	0.861 $\pm$ 0.006	0.956 $\pm$ 0.004	0.720 $\pm$ 0.003	0.95 $\pm$ 0.05
MLP (seq-pooled) [ 2 ]	0.979 $\pm$ 0.002	0.913 $\pm$ 0.003	0.847 $\pm$ 0.006	0.952 $\pm$ 0.004	0.780 $\pm$ 0.003	0.62 $\pm$ 0.05
1D-CNN [ 14 ]	0.986 $\pm$ 0.002	0.932 $\pm$ 0.003	0.872 $\pm$ 0.006	0.961 $\pm$ 0.004	0.640 $\pm$ 0.003	0.55 $\pm$ 0.05

TABLE I: Main results on ToN_IoT (chronological test, in-distribution attacks). Mean

\pm

std over 5 seeds.

\uparrow

higher is better;

\downarrow

lower is better.

Model	AUC-ROC $\uparrow$	AUC-PR $\uparrow$	Recall@1%FPR $\uparrow$
LightGBM	0.944 $\pm$ 0.003	0.612 $\pm$ 0.006	0.702 $\pm$ 0.010
1D-CNN	0.952 $\pm$ 0.003	0.645 $\pm$ 0.006	0.724 $\pm$ 0.010
BiLSTM	0.957 $\pm$ 0.003	0.662 $\pm$ 0.006	0.739 $\pm$ 0.010
Transformer (base)	0.962 $\pm$ 0.003	0.684 $\pm$ 0.006	0.752 $\pm$ 0.010
ThreatFormer-IDS (Ours)	0.971 $\pm$ 0.003	0.721 $\pm$ 0.006	0.783 $\pm$ 0.010

TABLE II: Zero-day evaluation on held-out attack categories (

\mathcal{C}_{\mathrm{ood}}

). Mean

\pm

std over 5 seeds.

$\epsilon$	0.00	0.25	0.50	0.75	1.00
LightGBM	0.926	0.881	0.812	0.741	0.669
Transformer (base)	0.944	0.902	0.848	0.792	0.736
ThreatFormer-IDS (Ours)	0.956	0.932	0.904	0.872	0.839

TABLE III: Adversarial robustness (AUC-PR) under

\ell_{\infty}

perturbations on standardized features.

Variant	AUC-PR $\uparrow$	Recall@1%FPR $\uparrow$	FPR@95%TPR $\downarrow$
ThreatFormer-IDS (Full)	0.956 $\pm$ 0.003	0.910 $\pm$ 0.006	0.490 $\pm$ 0.003
w/o self-supervision ( $\lambda_{\mathrm{ssl}}=0$ )	0.948 $\pm$ 0.003	0.898 $\pm$ 0.006	0.540 $\pm$ 0.003
w/o adversarial training ( $\epsilon=0$ )	0.950 $\pm$ 0.003	0.902 $\pm$ 0.006	0.525 $\pm$ 0.003
smaller context (halve $L$ )	0.947 $\pm$ 0.003	0.895 $\pm$ 0.006	0.552 $\pm$ 0.003

TABLE IV: Ablation on chronological test (in-distribution). Mean

\pm

std over 5 seeds.

Fig. 2: AUC-PR comparison (chronological test) consistent with Table I .

Fig. 3: Recall@1%FPR comparison (chronological test) consistent with Table I .

Fig. 4: AUC-PR over later chronological test blocks (drift trend).

Fig. 5: Adversarial robustness curve (AUC-PR vs.

\epsilon

) matching Table III .

Fig. 6: Example feature attribution heatmap (time $\times$ feature) for an alerted sequence.

Explore similar work

Do Transformers Actually Help Intrusion Detection? A Temporal Sequence Evaluation on CIC-IDS2017
Jun 9, 2026Zach Moczkodan, Hany RagabData Leakage Network Intrusion Detection
Royal Military College of Canada, Kingston, Canada · Department of Electrical and Computer Engineering, Faculty of Engineering, Royal Military College of Canada (RMC), Kingston, Ontario, K7K 7B4, Canada.
Collaborative Zone-Adaptive Zero-Day Intrusion Detection for IoBT
Feb 18, 2026Amirmohammad Pasdar, Shabnam Kasra Kermanshahi, Nour Moustafa +1Network Intrusion Detection Internet of Things
School of Computing and Information Systems, The University of Melbourne, VIC 3010, Australia · School of Systems & Computing, University of New South Wales, ACT 2612, Australia
Boundary-Seeking GAN-Augmented TabTransformer for Adversarially Robust Intrusion Detection
Jul 17, 2026Raihan Sultan Pasha Basuki, Aliyah KurniasihSynthetic Data Augmentation Transformer
Department of Computer Science, Universitas Ary Ginanjar, Menara 165, Cilandak No.kav 1 Lt 2 & 18, Jakarta Selatan, 12560, DKI Jakarta, Indonesia

Jun 9, 2026J/K move · Enter open · S save

Do Transformers Actually Help Intrusion Detection? A Temporal Sequence Evaluation on CIC-IDS2017

Zach Moczkodan, Hany Ragab

Royal Military College of Canada, Kingston, Canada · Department of Electrical and Computer Engineering, Faculty of Engineering, Royal Military College of Canada (RMC), Kingston, Ontario, K7K 7B4, Canada.

Data Leakage Network Intrusion Detection Time Series Transformers Sequence Modeling

Open paper AskPDF arXiv

Recent deep learning approaches for network intrusion detection increasingly incorporate temporal architectures such as recurrent networks and Transformers, often reporting near-perfect performance on CIC-IDS2017. However, many existing studies neither supply their temporal modules with genuine sequence inputs nor evaluate under realistic, leakage-free conditions, making it unclear whether reported gains arise from true sequence-modeling capability. In this work, we reformulate CIC-IDS2017 as a temporal intrusion-detection task by constructing ordered flow sequences from network conversations and benchmarking nine classical and deep learning architectures under a random split, two leakage-free splits, and a padding-scheme ablation. The central finding is that padding convention, not architecture, determines the Transformer's performance: on genuinely sequential (non-padded) windows the Transformer achieves the highest macro-F1 of any model in the experiment (0.89); under zero-pad+mask evaluation it drops markedly (-0.24 macro-F1), while LSTM, GRU, and 1D-CNN remain stable. Under leakage-free group evaluation the Random Forest is the most robust model (+0.009), while the Transformer's false-alarm rate grows from 0.04% to 2.7%, a 67-fold increase invisible under conventional protocols. These findings demonstrate that evaluation methodology -- specifically padding convention and split protocol -- has a larger effect on reported performance than architectural choice, and that widely used random splits with repeat-last padding can overestimate model robustness by up to 0.24 macro-F1. We advocate leakage-free splits, explicit padding disclosure, and sequence-aware benchmarking as standard practice in future IDS research. Code and implementation details are available at https://github.com/zachmocz/temporal-ids-bench.

Abstract

Explore similar work

Do Transformers Actually Help Intrusion Detection? A Temporal Sequence Evaluation on CIC-IDS2017

Collaborative Zone-Adaptive Zero-Day Intrusion Detection for IoBT

Boundary-Seeking GAN-Augmented TabTransformer for Adversarially Robust Intrusion Detection