NetPacketformer: Real-Time, Context-Aware Network Intrusion Detection with Transformers

Current Intrusion Detection Systems (IDS) often employ preprocessing steps to extract contextual information from raw traffic data, which require the system to wait for the communication to end, making them unsuitable for realtime use. Additionally, network intrusion detection models that utilize the raw packets consider only single packets, and do not work on sequences of packets. In this paper, we introduce NetPacketformer, a real-time network intrusion detection model that works directly on raw packet sequences. NetPacketformer leverages raw traffic and takes advantage of a Conformer encoder, originally designed for speech processing, to capture both local details (through convolution) and global patterns (through multi-head attention). We perform experiments on five publicly available datasets covering IoT, IIoT, IoMT, 5G, and standard IP networks, introduce two baseline sequence models based on LSTMs and Transformers, and show that NetPacketformer consistently outperforms them in both binary and multiclass detection tasks. When compared to state-of-the-art raw packet intrusion detection methods, NetPacketformer outperforms them in multiclass classification and is competitive in binary classification, while exhibiting an order of magnitude lower time-toclassification. Finally, we present a real-time application of our model on a Arm64 IoT device. Overall, these findings highlight how utilizing sequence modelling architectures can significantly improve intrusion detection. NetPacketformer is a flexible tool for researchers in the cybersecurity field aiming to implement real-time intrusion detection.