Open Access

ARTICLE

Deep Learning-Driven Intrusion Detection and Defense Mechanisms: A Novel Approach to Mitigating Cyber Attacks

Junzhe Cheng^*

Software Engineering Major, School of Information Engineering, Henan University of Animal Husbandry and Economy, Zhengzhou, 450000, China

* Corresponding Author: Junzhe Cheng. Email:

Journal of Cyber Security 2025, 7, 343-357. https://doi.org/10.32604/jcs.2025.067979

Received 17 May 2025; Accepted 14 August 2025; Issue published 22 September 2025

Abstract

We present a novel Transformer-based network intrusion detection system (IDS) that automatically learns complex feature relationships from raw traffic. Our architecture embeds both categorical (e.g., protocol, flag) and numerical (e.g., packet count, duration) inputs into a unified latent space with positional encodings, and processes them through multi-layer multi-head self-attention blocks. The Transformer’s global attention enables the IDS to capture subtle, long-range correlations in the data (e.g., coordinated multi-step attacks) without manual feature engineering. We complement the model with extensive data augmentation (SMOTE, GANs) to mitigate class imbalance and improve robustness. In evaluation on benchmark datasets (UNSW-NB15, CIC-IDS2017, NSL-KDD), the Transformer-IDS achieves ~99% precision and recall, significantly outperforming a CNN baseline and matching or exceeding recent deep-learning IDS methods. We conduct ablation studies to quantify the impact of design choices (number of attention heads, layers, attention type), and perform explainability analysis using SHAP values and attention-weight heatmaps to identify which features drive decisions. We also assess adversarial robustness, showing that the model’s accuracy degrades under FGSM/PGD attacks but can be partially recovered with adversarial training (drawn from trends in vision models). Finally, we evaluate real-time mitigation, integrating our IDS in a simulated SDN controller to measure detection latency and false-intercept rates under live traffic. Our results show the system can flag >98% of attacks with <1% false alarms, in ~1–2 ms per flow, making it practical for deployment. This work advances IDS research by combining high accuracy with transparency and robustness to unseen threats.

---

Keywords

---