A Robust PPO-optimized Tabular Transformer Framework for Intrusion Detection in Industrial IoT Systems

2025-05-23 · Yuanya She

In this paper, we propose a robust and reinforcement-learning-enhanced network intrusion detection system (NIDS) designed for class-imbalanced and few-shot attack scenarios in Industrial Internet of Things (IIoT) environments. Our model integrates a TabTransformer for effective tabular feature representation with Proximal Policy Optimization (PPO) to optimize classification decisions via policy learning. Evaluated on the TON\textunderscore IoT benchmark, our method achieves a macro F1-score of 97.73\% and accuracy of 98.85\%. Remarkably, even on extremely rare classes like man-in-the-middle (MITM), our model achieves an F1-score of 88.79\%, showcasing strong robustness and few-shot detection capabilities. Extensive ablation experiments confirm the complementary roles of TabTransformer and PPO in mitigating class imbalance and improving generalization. These results highlight the potential of combining transformer-based tabular learning with reinforcement learning for real-world NIDS applications.

📄 PDF Abstract BibTeX arXiv:2505.18234

Code (1)

RussellTNY/PPO-optimized-Tab-Transformer-for-NIDS-on-TON_IoT 공식 구현

Tasks

Intrusion Detection Network Intrusion Detection reinforcement-learning Reinforcement Learning

Methods 이 논문이 사용한 방법론

Attention 설명 없음

Linear Layer A Linear Layer is a projection $\mathbf{XW + b}$.

Layer Normalization Unlike batch normalization, Layer Normalization directly estimates the normalization statistics from the summed inputs…

Residual Connection 설명 없음

Dense Connections Dense Connections, or Fully Connected Connections, are a type of layer in a deep neural network that use a linear operation where every input is connected to every output…

Entropy Regularization 설명 없음

Softmax The Softmax output function transforms a previous layer's output into a vector of probabilities. It is commonly used for multiclass classification. Given an input vector $x$…

Position-Wise Feed-Forward Layer 설명 없음

MAGE-ID: A Multimodal Generative Framework for Intrusion Detection Systems

2025-12-03 · Mahdi Arab Loodaricheh, Mohammad Hossein Manshaei, Anita Raja arxiv

Modern Intrusion Detection Systems (IDS) face severe challenges due to heterogeneous network traffic, evolving cyber threats, and pronounced data imbalance between benign and attack flows. While generative models have sh…

Intrusion Detection Data Augmentation

Self-Supervised Learning of Graph Representations for Network Intrusion Detection

2025-09-20 · Lorenzo Guerra, Thomas Chapuis, Guillaume Duc, Pavlo Mozharovskyi 외 arxiv

Detecting intrusions in network traffic is a challenging task, particularly under limited supervision and constantly evolving attack patterns. While recent works have leveraged graph neural networks for network intrusion…

Network Intrusion Detection Self-Supervised Learning Representation Learning Graph Neural Network

Evaluating Tabular Representation Learning for Network Intrusion Detection

2026-05-04 · Muhammad Usman Butt, Andreas Hotho, Daniel Schlör arxiv

Classic Network Intrusion Detection Systems (NIDS) often rely on manual feature engineering to extract meaningful patterns from network traffic data. However, this approach requires domain expertise and runs counter to t…

Unsupervised Anomaly Detection Network Intrusion Detection Representation Learning Feature Engineering

SAFE: Self-Supervised Anomaly Detection Framework for Intrusion Detection

2025-02-10 · Elvin Li, Zhengli Shang, Onat Gungor, Tajana Rosing

The proliferation of IoT devices has significantly increased network vulnerabilities, creating an urgent need for effective Intrusion Detection Systems (IDS). Machine Learning-based IDS (ML-IDS) offer advanced detection …

Anomaly Detection Intrusion Detection Network Intrusion Detection Self-Supervised Anomaly Detection+2

Machine Unlearning for the XGBoost Model with Network Intrusion Datasets

2026-06-17 · Diana Magalhães, Eva Maia, João Vitorino, Isabel Praça arxiv

Machine Unlearning (MU) has emerged as an important technique for removing specific data points from trained models without requiring full retraining. However, most existing MU research focuses on deep learning and image…

Network Intrusion Detection