Adaptive Hybrid Intrusion Detection Model byGenetic Algorithm and Transformer with Dynamic Feature Selection on behalf of Performance Optimization

Abstract

Conventional intrusion detection systems were found to possess significant vulnerabilities to dynamic environments in changing networks, particularly with regards to their inability to adapt with the dynamic nature of attacks as well as their high sensitivity to high-dimensional features. In this paper, both a dynamic genetic algorithm-based feature selection method and Transformer based detection are interrelated and make up an adaptive hybrid intrusion detection model. The procedure followed a periodical re-selection process, triggered by an event that occurred as a result of the degradation in the performance as well as identification of statistical drift, and thus evolve with the variations in the data distributions. Transformer-based Transforming core was used, which utilized multi-heading self attention (MHSA) to represent the high-order interaction between features, and a hybrid output layer (HOL) that combined anomaly detection and multi-class classification. The model was evaluated on three baseline methods in large-scale experiments on two benchmark data, CIC-IDS2017 and UNSW-NB15. The findings prove that the proposed model achieves F1 scores of 97.64% and 95.02% on CIC-IDS2017 and UNSW-NB15, which is significantly higher than the baseline models by 2.09% to 9.69. The active selection mechanism was dynamic resulting in an average reduction of the number of active features by 42.3, which consequently meant a similar reduction in the inference time and no deterioration of the detection accuracy. In the simulated changes of the data distribution, the adaptive component performance remained consistent above the F1-score of 96.5% throughout the rest of the testing. Based on the inference latency of 14.2 milliseconds per sample and a highest memory utilization of 4.2 GB to 4.8 GB, the model suggested was considered to be viable to be used in a real-time environment. The results showed that combining dynamic feature selection with Transformer-based detection was a good method for intrusion detection in non-stationary network environments, overcoming the major limitations of existing methods and preserving enough computational efficiency to allow the possibility of practical use.