Network Anomaly Detection System using Transformer Neural Networks and Clustering Techniques

Abstract

This study proposes a hybrid approach for network anomaly detection by integrating a Transformer-based model with clustering techniques. The methodology begins with the application of K-means clustering as a preprocessing step to group similar network traffic data, thereby reducing data complexity and highlighting significant patterns. The clustered data is then fed into a Transformer model, which utilizes multi-head self-attention mechanisms to capture intricate temporal dependencies and contextual relationships within sequential data. This dual-stage approach enhances the model’s ability to differentiate between normal and anomalous behaviors in network traffic. Trained on a network security dataset, the system effectively identifies both common and rare attack types. According to the results, the suggested ensemble classifier outperformed existing deep learning models with an accuracy of over 99.5%, 98.5%, and 99.9% on the UNSW-NB15 dataset. The synergy between the unsupervised pattern recognition of clustering and the deep learning capabilities of Transformers enables a scalable and adaptable solution for real-world network security applications, making it suitable for proactive cyber threat detection and mitigation.