Time Series Based Network Intrusion Detection using MTF-Aided Transformer

2025-08-21

AI Summary

To address the challenge of temporal intrusion detection under data-scarce conditions in Software-Defined Networking (SDN), this paper proposes MTF-Transformer—a novel architecture that pioneers the integration of Markov Transition Fields (MTF) into the Transformer framework. MTF converts raw time-series traffic features into discriminative 2D image-like representations, thereby enhancing both local and global temporal dependency modeling while significantly improving feature discriminability in few-shot scenarios. The design achieves an optimal trade-off between representational capacity and computational efficiency. Evaluated on the InSDN dataset, MTF-Transformer outperforms CNN, LSTM, and standard Transformer baselines, achieving absolute accuracy gains of 3.2–9.7% and accelerating training and inference by 1.8× and 2.3×, respectively. With its lightweight structure and strong robustness, the model is well-suited for real-time, resource-constrained SDN security monitoring deployments.

Technology Category

• Machine Learning: Time-Series/Data Streams
• Data Mining & Knowledge Management: Mining of Spatial, Temporal or Spatio-Temporal Data
• Planning, Routing, and Scheduling: Optimization of Spatio-temporal Systems

Application Category

• Systems and Infrastructure for Web, Mobile and WoT: Applied ML and AI for Web-based mobile applications
• Security and Privacy: Large-scale security measurements
• Graph Algorithms and Modeling for the Web: Representation, reconstruction, and subgraph or motif discovery in Web-related graphs

Abstract

This paper introduces a novel approach to time series classification using a Markov Transition Field (MTF)-aided Transformer model, specifically designed for Software-Defined Networks (SDNs). The proposed model integrates the temporal dependency modeling strengths of MTFs with the sophisticated pattern recognition capabilities of Transformer architectures. We evaluate the model's performance using the InSDN dataset, demonstrating that our model outperforms baseline classification models, particularly in data-constrained environments commonly encountered in SDN applications. We also highlight the relationship between the MTF and Transformer components, which leads to better performance, even with limited data. Furthermore, our approach achieves competitive training and inference times, making it an efficient solution for real-world SDN applications. These findings establish the potential of MTF-aided Transformers to address the challenges of time series classification in SDNs, offering a promising path for reliable and scalable analysis in scenarios with sparse data.

Problem

• Detecting network intrusions in SDNs using time series
• Improving classification with limited data via MTF-Transformer integration
• Enhancing real-time analysis efficiency for sparse data scenarios

Innovation

• MTF-aided Transformer for time series classification
• Integrates MTF temporal dependency with Transformer pattern recognition
• Efficient solution for data-constrained SDN environments