Transparent autoencoding of network packets with self-attention-based transformers

Deep learning based autoencoders are a promising technology for network-based attack detection systems. They provide advantages for the handling of unknown network traces or new attack signatures. Especially for the application in critical infrastructures (e.g. in power supply) intrusion detection systems have to fulfill high requirements regarding the model accuracy and trustfulness. Transformers represent the state-of-the-art for learning from sequential data and provide more model insight through the wide-spread use of attention mechanisms. This paper presents a transformer-based network autoencoder using self-attention mechanisms within a two-stage encoder and decoder design. First results on the ISCX-IDS 2012 benchmark dataset are shown including a visualization of the encoder attention weights for exemplary network packet sequences.