# Novel transformer-based model for NID in fog computing environment

## TL;DR

This paper introduces a new Transformer-based model for detecting network intrusions in fog computing environments, achieving high accuracy and interpretability.

## Contribution

A novel Transformer-based framework for NID in fog computing with high performance and interpretability using attention mechanisms and explainable AI.

## Key findings

- The model achieves 100% accuracy, precision, recall, and F1-score on the NSL-KDD dataset.
- It demonstrates 99.60% accuracy in binary classification and 95.37% in multiclass classification on the IoT-20 dataset.
- Attention mechanisms and explainable AI techniques improve interpretability and practical applicability.

## Abstract

In fog computing, efficient and accurate network intrusion detection (NID) is critical due to the unique security challenges of distributed architectures. This research proposes a novel Transformer-based framework for NID, leveraging advanced Transformer architectures to improve feature extraction and intrusion classification. The proposed model is intended to detect different types of attack related to the attack categories including Denial-of-Service, Probe, Remote-to-Local, and User-to-Root. The proposed model utilized both the NSL-KDD and IoT-20 datasets. The results of the conducted experiments reveal that the model achieves 100% accuracy, precision, recall, and F1-score on NSL-KDD dataset while it demonstrates 99.60% accuracy in binary classification and 95.37% in multiclass classification on IoT-20 dataset. To ensure the robustness and overfitting mitigation, the model utilized cross-validation, regularization, and adversarial testing. In addition, the inclusion of the IoT-20 dataset ensures relevance to contemporary network security challenges, while attention mechanisms and explainable AI techniques enhance interpretability and practical applicability. This study highlights the transformative potential of Transformer-based models for NID in fog computing, offering a robust, scalable, and interpretable solution for securing distributed architectures.