Hybrid transformer framework detects DDoS attacks with high accuracy in benchmark tests

Researchers have unveiled a hybrid machine learning framework, called NEAT-ID (Neuro-Evolutionary Attention-Enhanced Transformer for Intrusion Detection), designed to identify Distributed Denial-of-Service (DDoS) attacks in network traffic. Writing in Cluster Computing, Fahdah A. Almarshad, Mohammed Zakariah and Ghada A. Gashgari report that the framework combines several complementary techniques: genetic algorithm-based feature selection, Transformer embeddings with a mutual-information bias, symbolic features derived from RuleFit, temporal encoding using Wavelet-LSTM, and a histogram-based gradient boosting classifier. The approach was evaluated on a stratified subset of the CIC-DDoS2019 dataset, which contains both benign and DDoS traffic.

The work addresses three persistent obstacles facing intrusion detection systems: very high traffic volumes, severe class imbalance between benign and malicious flows, and attack patterns that change over time. The authors argue that these combined challenges motivate integrating contextual, temporal and symbolic representations within one pipeline rather than relying on a single classifier type.

On the held-out test set, NEAT-ID achieved 96.79% accuracy, 97.62% precision, 97.96% recall and a 97.79% F1-score. Under 10-fold cross-validation, the framework recorded an accuracy of 97.18% ± 0.18% and an F1-score of 97.17% ± 0.18%, indicating stable performance across data splits. The precision and recall figures suggest the detector balanced false alarms against missed attacks, a critical trade-off in operational settings where both over-sensitive and under-sensitive detectors impose costs.

Ablation experiments, in which individual modules are removed to measure their contribution, indicated that the Wavelet-LSTM temporal encoding and the attention-based modules have a measurable impact on predictive ability. The experiments also suggested that RuleFit offers a rule-based representation that remains interpretable, addressing a common criticism of deep learning detectors whose internal decisions are difficult to explain. The authors present these findings as evidence that integrating contextual, temporal and symbolic representations in a single framework can yield competitive DDoS detection performance.

The study is careful to distinguish demonstrated results from future possibilities. CPU-based profiling suggested that low-latency inference appears possible on conventional hardware, but the authors explicitly state that deploying the analysis in live networks in real time, validating the framework against other datasets, and explicitly testing it against new attack families remain open areas for future work. Because the evaluation relied on a stratified subset of a single benchmark dataset, the reported figures describe performance under those specific test conditions rather than a guarantee of behavior against unseen attack types.

The findings arrive amid continued interest in machine learning defenses against DDoS attacks, where high traffic volume, class imbalance and evolving attack behavior remain major obstacles for intrusion detection systems. By showing that evolutionary feature selection, attention-based Transformers, wavelet-informed temporal encoding and symbolic rules can be combined in one detector, the authors highlight an integration path that other research groups may explore. For now, the results illustrate competitive performance on the CIC-DDoS2019 benchmark and frame real-time network deployment and broader validation as the next steps toward practical use.

Subject of Research: Machine learning framework for DDoS attack detection using a neuro-evolutionary attention-enhanced transformer

Article Title: NEAT-ID: cybersecurity intrusion detection using neuro-evolutionary attention-enhanced transformer

Article References: Almarshad, F. A., Zakariah, M., & Gashgari, G. A. (2026). NEAT-ID: cybersecurity intrusion detection using neuro-evolutionary attention-enhanced transformer. Cluster Computing, 29(16), Article 894. https://doi.org/10.1007/s10586-026-06715-4

Image Credits: AI Generated

DOI: 10.1007/s10586-026-06715-4

Keywords: cybersecurity, DDoS, intrusion detection, transformer, machine learning, NEAT-ID, neuro-evolutionary, attention mechanism, Wavelet-LSTM, RuleFit, CIC-DDoS2019, Cluster Computing