Research map / Architectures and efficiency / Attention and transformers

MalDetectFormer: Leveraging Sparse SpatioTemporal Information for Effective Malicious Traffic Detection

AAAI 2025 · Architectures and efficiency › Attention and transformers · approach: Transformer neural operators for PDEs · 1 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Proposes MalDetectFormer, a Transformer variant with sparse and time-cycle attention plus a sub-graph convolutional network that exploits spatiotemporal patterns to detect malicious network traffic.

Problem

Malicious traffic detection struggles with the sparsity, long duration, and persistence of attacks, and with class imbalance; single-observation methods and standard Transformers miss these persistent spatiotemporal patterns.

Approach

Combines a sparsity-regularized attention (SparseTimeCycle Attention) that attends across time intervals rather than individual points, a time-period positional embedding, and a sub-graph convolutional network over IP and subnet graphs to capture attacker-victim spatial concentration.

Key results

• On UNSW-NB15 (nine attack types), MalDetectFormer reaches 0.9857 accuracy and 0.9985 AUC, versus 0.8341 accuracy for the best LSTM baseline.
• On CIC-IDS-2017 PortScan, the full model reaches 0.9993 accuracy and F1, against 0.9825 accuracy for LSTM.
• The full model outperforms the Transformer-family baselines (Transformer, Informer, Autoformer, FEDFormer) across most CIC-IDS-2017 attack files.

Measured effects reported in the paper

Surprising findings

• Standard Transformer-family models degrade sharply on realistic mixed-attack traffic, with several reporting near-chance AUC on UNSW-NB15 and CIC-IDS-2017 subsets.
• On UNSW-NB15, the full model has lower precision (0.9671) and recall (0.9588) than the sparse-only ablation's recall of 0.9813, suggesting a trade-off.

Limitations

• Evaluated only on two public intrusion datasets (CIC-IDS-2017 and UNSW-NB15) with no reported efficiency measurements.
• Dataset splits differ across files and attack types, so comparisons across settings are not uniform.
• Sparsity-rate adaptation mechanism and hyperparameters (alpha, beta, p0) are described without a detailed sensitivity analysis.

Experimental setup

Datasets: CIC-IDS-2017 UNSW-NB15

Benchmarks: CIC-IDS-2017 UNSW-NB15

Metrics: accuracy precision recall F1 AUC

Baselines: LSTM CNN BiLSTM-CNN Transformer Informer Autoformer FEDFormer GMM

Builds on: Transformer Informer Autoformer FEDFormer Graph Attention Network

Closest papers by meaning

• DiffuPac: Contextual Mimicry in Adversarial Packets Generation via Diffusion Model (NeurIPS 2024 · similarity 0.81)
• MIETT: Multi-Instance Encrypted Traffic Transformer for Encrypted Traffic Classification (AAAI 2025 · similarity 0.81)
• DRSM: De-Randomized Smoothing on Malware Classifier Providing Certified Robustness (ICLR 2024 · similarity 0.80)
• Efficient Traffic Prediction Through Spatio-Temporal Distillation (AAAI 2025 · similarity 0.80)
• MoniTor: Exploiting Large Language Models with Instruction for Online Video Anomaly Detection (NeurIPS 2025 · similarity 0.80)
• Self-Supervised Learning of Graph Representations for Network Intrusion Detection (NeurIPS 2025 · similarity 0.80)