Time Series Based Network Intrusion Detection using MTF-Aided Transformer

TL;DR

This paper presents a novel MTF-aided Transformer model for time series classification in SDNs, outperforming baselines especially with limited data, and demonstrating efficiency and scalability for real-world applications.

Contribution

It introduces a new MTF-aided Transformer architecture tailored for SDN time series classification, combining temporal modeling with pattern recognition.

Findings

Outperforms baseline models in SDN time series classification

Maintains high performance with limited training data

Offers efficient training and inference times

Abstract

This paper introduces a novel approach to time series classification using a Markov Transition Field (MTF)-aided Transformer model, specifically designed for Software-Defined Networks (SDNs). The proposed model integrates the temporal dependency modeling strengths of MTFs with the sophisticated pattern recognition capabilities of Transformer architectures. We evaluate the model's performance using the InSDN dataset, demonstrating that our model outperforms baseline classification models, particularly in data-constrained environments commonly encountered in SDN applications. We also highlight the relationship between the MTF and Transformer components, which leads to better performance, even with limited data. Furthermore, our approach achieves competitive training and inference times, making it an efficient solution for real-world SDN applications. These findings establish the potential of MTF-aided Transformers to address the challenges of time series classification in SDNs, offering a promising path for reliable and scalable analysis in scenarios with sparse data.