Deep learning architectures for network traffic analysis

Modern deep learning architectures have revolutionized network traffic analysis through their ability to automatically extract complex patterns from high-dimensional data [33]. The evolution of these architectures has enabled increasingly sophisticated approaches to anomaly detection [34], particularly in handling the complex, multi-dimensional nature of network traffic data [35].

Convolutional Neural Networks (CNNs) have demonstrated remarkable capabilities in capturing spatial correlations within network traffic features. For an input traffic sequence representing timesteps and features, CNN applies hierarchical feature extraction through convolution operations: , where W represents learnable filters and σ is a nonlinear activation function. This architecture’s inherent ability to learn hierarchical features has proven particularly effective in identifying spatial patterns characteristic of network attacks [36], eliminating the need for manual feature engineering that often limits traditional approaches.

The temporal aspects of network traffic necessitate architectures capable of capturing sequential dependencies [37]. Long Short-Term Memory (LSTM) networks address this challenge through a sophisticated gating mechanism that effectively prevents gradient vanishing in processing long sequential data [38]. The core operations of LSTM are governed by (1):

(1)

(2)

(3)

(4)

(5)

In this formulation, the gating mechanisms () control information flow through the network, enabling the model to capture long-term dependencies crucial for detecting evolving attack patterns [39]. The LSTM’s ability to maintain and update internal state makes it particularly effective in identifying attacks that manifest over extended time periods [40].

The Transformer architecture represents a significant advancement in sequence modeling through its introduction of self-attention mechanisms. The core attention operation is defined as (6)

(6)

where and represent learnable transformations of the input features. This mechanism enables the model to dynamically capture global dependencies across entire traffic sequences, offering unprecedented capabilities in identifying complex attack patterns that manifest across different time scales [41]. The multi-head attention mechanism further enhances this capability by allowing the model to attend to different aspects of the input simultaneously [42].

Data drift detection in network security

Network traffic patterns exhibit inherent temporal evolution, manifesting as data drift when the distribution of traffic patterns shifts between the training (source) domain p_s(x) and the operational (target) domain p_t(x). This phenomenon poses a fundamental challenge to the long-term effectiveness of anomaly detection systems [43]. The performance degradation under drift can be quantified through the accuracy metric (7):

(7)

which typically decreases when .

The detection and adaptation to data drift have emerged as critical components of robust network security systems. However, traditional single-metric drift detection methods face a fundamental limitation in network security contexts: the temporal decoupling between statistical significance and functional impact. Methods like ADWIN [44] may trigger unnecessary adaptations for benign traffic changes, while performance-only approaches like DDM [45] may miss early indicators of sophisticated attacks. Our multi-metric approach addresses this challenge by requiring simultaneous validation across statistical, performance, and distributional dimensions, enabling systems to maintain detection efficacy through adaptive learning while preserving knowledge of previously encountered attack signatures.

Self-learning mechanisms

Self-learning mechanisms enable anomaly detection systems to adapt autonomously using unlabeled traffic data, addressing the practical constraints of obtaining labeled samples in operational environments. The autoencoder paradigm exemplifies this approach, learning normal traffic patterns through the optimization objective (8):

(8)

where and represent encoder and decoder functions respectively [46]. This framework enables the identification of anomalies through reconstruction error analysis, providing a foundation for unsupervised adaptation to evolving traffic patterns.

Recent studies have introduced more sophisticated self-learning approaches, including contrastive learning for feature space optimization. The contrastive learning objective can be formulated as (9):

(9)

where represents two augmented views of the same traffic sample, and represents the other negative samples. This approach enables the model to learn discriminative features without explicit labels.

Furthermore, adaptive threshold mechanisms have been developed to dynamically adjust detection boundaries. The adaptive threshold at time t can be updated according to (10):

(10)

where and represent the running mean and standard deviation of the anomaly scores, and α is a sensitivity parameter that controls the detection boundary. The integration of these self-learning mechanisms with deep learning architectures has opened new possibilities for autonomous, adaptive anomaly detection systems. The combination of representation learning and adaptive mechanisms enables continuous model refinement while maintaining robustness to concept drift, a crucial capability in operational network security environments [47].

Framework overview

The rapid evolution of cyber threats presents unprecedented challenges to network security systems, characterized by sophisticated attack patterns and dynamic behavior changes. Traditional approaches often struggle with these challenges, particularly in scenarios involving zero-day attacks and concept drift. We propose a novel hybrid deep learning framework, as illustrated in S1 Fig, that integrates specialized neural architectures with adaptive learning mechanisms to address these challenges effectively.

Our framework employs a hierarchical detection paradigm that decomposes network anomaly detection into two specialized stages, each optimized for specific aspects of the detection task, with detailed architecture specifications shown in Table 1. The first stage utilizes a CNN-LSTM architecture for binary classification, leveraging CNN’s capability to extract spatial correlations while LSTM captures temporal dependencies. The second stage employs an LSTM-Transformer architecture for fine-grained attack classification, where the Transformer’s self-attention mechanism enables complex pattern recognition across different traffic characteristics.

Download:

• PPT
  PowerPoint slide
• PNG
  larger image
• TIFF
  original image

Table 1. Model architecture specifications for two-stage deep learning framework.

https://doi.org/10.1371/journal.pone.0332502.t001

Two-stage deep model fusion

The CNN-LSTM module serves as the framework’s initial detection layer, transforming network traffic features through hierarchical convolution operations. The CNN component maps input data into a structured feature space where spatial correlations between traffic attributes are captured. For a traffic sequence with timesteps and features, the CNN applies feature extraction through convolution operations, enabling the identification of local patterns indicative of anomalous behavior.

The LSTM-Transformer module builds upon the binary classification results, processing identified anomalous traffic for detailed attack type classification. This stage employs bidirectional LSTM layers to create rich temporal representations, followed by a Transformer encoder that uses multi-head self-attention to capture global dependencies. This architecture enables the model to identify subtle differences between attack types while maintaining computational efficiency.

This hierarchical integration addresses the multi-scale nature of network traffic anomalies that single-model approaches cannot handle effectively. Network attacks manifest across different temporal and spatial scales—from microsecond-level packet timing anomalies to hour-long distributed attack campaigns. Independent CNN processing captures local traffic correlations but misses extended attack sequences, while standalone LSTM analysis models temporal patterns but struggles with high-dimensional feature interactions. Direct Transformer application to raw network traffic creates computational overhead that prevents real-time processing in operational environments.

The two-stage architecture optimizes detection efficiency by matching computational complexity to analysis requirements. Binary anomaly detection requires less sophisticated pattern analysis than fine-grained attack classification, making CNN-LSTM processing suitable for initial filtering. The subsequent LSTM-Transformer stage applies intensive analysis only to suspected anomalous traffic, achieving comprehensive detection while maintaining operational feasibility. This design enables the framework to process typical network speeds of 10-500 Mbps while preserving detection accuracy for complex attack patterns.

Adaptive learning mechanism

The framework implements its self-learning capability through an adaptive learning mechanism that enables autonomous response to evolving attack patterns while preserving knowledge of known threats. As illustrated in S2 Fig, this mechanism operates through multi-metric drift detection and selective model updating. The system monitors potential distribution shifts between the source domain p_s(x) and target domain p_t(x) through statistical testing and performance monitoring, triggering adaptation when significant changes are detected. This adaptive learning mechanism represents the core of our framework’s self-learning ability, allowing it to continuously improve detection accuracy without human intervention as new attack patterns emerge.

Our multi-metric drift detection method employs a comprehensive approach to identify distribution shifts in network traffic patterns. The drift detection is formulated as follows:

Given a reference distribution Dref from the source domain p_s(x) and current traffic distribution D from the potential target domain p_t(x), we compute a composite drift score using three complementary metrics:

1. Statistical divergence (Dstat): We employ the Kolmogorov-Smirnov test to measure the statistical significance of distribution differences between reference and current traffic features (11): (11)
2. Performance degradation (Dperf): This metric quantifies the decline in model performance when applied to new traffic patterns (12): (12)
   where Performance() represents the model’s F1-score on the respective datasets.
3. Distribution shift (Ddist): We calculate the Jensen-Shannon divergence between feature distributions to capture subtle shifts that might not be reflected in immediate performance drops (13): (13)
   where and KL represents the Kullback-Leibler divergence.

These three metrics capture different aspects of potential drift: Dstat reflects statistically significant changes, Dperf indicates functional impact on model performance, and Ddist measures intrinsic distribution changes. The composite drift score is calculated as a weighted combination (14):

(14)

where α, β, and γ are importance weights determined through experimental validation. A drift is detected when drift_score exceeds threshold , triggering the model update process. This multi-metric approach provides robustness against false positives while ensuring sensitivity to meaningful distribution shifts across diverse network environments.

Model updates employ Elastic Weight Consolidation to preserve important parameters while adapting to new patterns. When a concept drift is detected, our framework initiates a systematic recovery process through the following steps:

1. Important parameter identification: The framework computes the Fisher Information Matrix F to identify parameters crucial for maintaining existing knowledge (15): (15)
   where represents individual model parameters and is the probability of predicting class y given input x.
2. Constrained optimization: The model parameters are updated with a loss function that balances new learning objectives against the preservation of existing knowledge (16): (16)
   where represents the original parameter values before update, and λ controls the strength of knowledge preservation.

This approach enables continuous adaptation to emerging threats while maintaining detection capability for known attack patterns. Through extensive experimentation, we determined that this process enables the model to recover baseline performance within 23.4 ± 0.20 hours post-drift detection, significantly faster than traditional retraining approaches.

The integration of these components creates a robust framework capable of maintaining high detection accuracy across diverse network environments while efficiently processing high-dimensional traffic data. The framework’s effectiveness is thoroughly evaluated through comprehensive experiments detailed in Sect 4.

Framework implementation

Our framework processes network traffic data through a sophisticated pipeline that transforms raw packet data into comprehensive traffic representations. The core components of our framework and their primary functions are summarized in Table 2.

Download:

• PPT
  PowerPoint slide
• PNG
  larger image
• TIFF
  original image

Table 2. Core components and their functions.

https://doi.org/10.1371/journal.pone.0332502.t002

The feature processing begins with traffic flow aggregation, where individual packets are grouped into meaningful flows based on their temporal and spatial relationships. This aggregation process considers both protocol-specific characteristics and statistical properties of the traffic patterns, enabling the framework to capture complex attack signatures that manifest across multiple packets or flows.

The CNN-LSTM module employs a hierarchical feature extraction approach, where convolutional layers progressively identify increasingly abstract patterns in the traffic data. Through careful architectural design, the CNN component captures local feature correlations while maintaining computational efficiency. The LSTM layers then analyze these features in their temporal context, enabling the detection of sophisticated attacks that evolve over time. The integration of these components allows the model to maintain high detection accuracy while processing traffic data in real-time.

The LSTM-Transformer module builds upon this foundation through its sophisticated attention mechanisms. By incorporating bidirectional LSTM encoding with multi-head self-attention, the module can identify subtle relationships between different aspects of anomalous traffic. This capability is particularly crucial for distinguishing between various attack types that may share similar surface characteristics but differ in their underlying patterns or intentions.

A critical aspect of our implementation is the self-learning mechanism’s integration with both detection stages. This mechanism continuously monitors the traffic distribution and model performance, automatically detecting when the current detection patterns need to be updated. The update process employs Elastic Weight Consolidation to prevent catastrophic forgetting, ensuring that the model maintains its ability to detect known attack patterns while adapting to new threats.

The framework’s effectiveness stems from the synergistic interaction between these components, enabling robust performance across diverse network environments and attack scenarios. Algorithm 1 illustrates the core detection process, while Algorithm 2 and Algorithm 3 detail the adaptive learning and drift detection mechanisms respectively. These algorithms collectively enable the framework to maintain high detection accuracy while efficiently processing high-dimensional traffic data in real-time environments.

Algorithm 1. Two-stage network anomaly detection.

Input:

Output:

1: Initialize model parameters , ,

3: for each traffic window w in X do

4:  

5:  

6:  

7:   if score > threshold then

9:   

10:   

11:    return

12:   end if

13: end for

14: return “normal”

Algorithm 2. Adaptive learning mechanism.

Input:

Output:

1:

2:

3:

4:

5: if then

6:  

7:  

8:  

9:  

10:   

11:    return

12: end if

13: return M

Algorithm 3. Real-time pattern analysis.

Input:

Output:

1: Initialize pattern buffer B

2: for each window W in do

3:  

4:  

5:  

6:   if then

7:   

8:   end if

9: end for

10: return

Experimental setup

Our experimental evaluation employs two widely-used network security datasets that represent different network environments and attack scenarios. The UNSW-NB15 dataset encompasses over 2.5 million records with 49 features, featuring nine distinct attack types generated in a controlled environment. The CICIDS2017 dataset contains approximately 2.8 million network flows with 78 features, captured from real-world network traffic and including 14 contemporary attack patterns. A detailed comparison of these datasets is presented in Table 3.

Download:

• PPT
  PowerPoint slide
• PNG
  larger image
• TIFF
  original image

Table 3. Dataset characteristics comparison.

https://doi.org/10.1371/journal.pone.0332502.t003

The data preprocessing pipeline consists of several systematic stages designed to enhance data quality and model performance:

1. Data cleaning: We addressed missing values using attribute-specific strategies: categorical features were filled with the most frequent value, while numerical features were imputed using the median value to minimize the influence of outliers. Duplicate records were removed to prevent biasing the model toward redundant patterns.
2. Normalization: Numerical features were standardized using z-score normalization (μ = 0, σ = 1) to ensure balanced contribution of features with different scales (17): (17)
   This step is particularly important for the gradient-based optimization in our deep learning models.
3. Outlier handling: We employed the Interquartile Range (IQR) method (τ = 1.5) to detect and address outliers (18): (18) (19)
   Values outside these bounds were capped rather than removed, preserving data points while limiting their potential to skew the model training.
4. Feature selection and dimensionality reduction: We implemented a multi-stage feature selection process:
   1. Initial filtering through correlation analysis (threshold = 0.1) to eliminate highly redundant features;
   2. Random Forest importance ranking to identify the most discriminative features;
   3. Sequential Forward Selection with cross-validation to optimize the feature subset while minimizing information loss.

Through comprehensive feature analysis, we identified the most significant contributors to attack detection performance across both datasets, as shown in S3 Fig. Flow duration and packet size consistently emerge as the most crucial features, with importance scores above 0.80 across both datasets, while protocol-specific characteristics show varying degrees of importance depending on the network environment.

To address potential redundancy in the feature space, we employed Principal Component Analysis (PCA) for the LSTM-Transformer stage, retaining components that explained 95% of the variance while reducing computational complexity. For the CNN-LSTM stage, we preserved the original feature space to maintain interpretability and spatial correlations.

This systematic feature engineering approach resulted in optimized feature sets of 35 and 45 features for UNSW-NB15 and CICIDS2017 respectively, balancing model performance with computational efficiency. The selected features encompass temporal characteristics, volumetric properties, and protocol-specific attributes, providing a comprehensive representation of network traffic patterns.

All experiments were conducted using TensorFlow 2.15.0 on a system equipped with Google Colaboratory environment, ensuring consistent evaluation conditions across all comparative analyses.

Performance evaluation

Our framework demonstrates superior performance across both datasets in binary anomaly detection and multi-class attack classification tasks. On the UNSW-NB15 dataset, the framework achieves an F1-score of 0.9778 for binary detection and 0.9632 accuracy for attack classification, representing significant improvements over existing approaches. The framework’s effectiveness is further validated on the CICIDS2017 dataset, achieving F1-scores of 0.9695 and 0.9528 for binary and multi-class tasks respectively. A comprehensive comparison with existing methods is presented in Tables 4 and 5.

Download:

• PPT
  PowerPoint slide
• PNG
  larger image
• TIFF
  original image

Table 4. Comparative performance analysis on UNSW-NB15 datasets.

https://doi.org/10.1371/journal.pone.0332502.t004

Download:

• PPT
  PowerPoint slide
• PNG
  larger image
• TIFF
  original image

Table 5. Comparative performance analysis on CICIDS2017 datasets.

https://doi.org/10.1371/journal.pone.0332502.t005

The results demonstrate that our integrated CNN-LSTM-Transformer framework outperforms both single-paradigm models and alternative hybrid architectures. Notably, while CTGAN shows competitive performance in binary detection, it underperforms in the more challenging multi-class scenario compared to our approach. The pure Transformer model, despite its theoretical advantages in capturing long-range dependencies, achieves lower F1-scores than our hybrid approach in both binary and multi-class detection tasks. This suggests that the integration of convolutional operations for spatial feature extraction with sequential and attention-based models for temporal analysis provides complementary capabilities that pure attention-based approaches cannot fully replicate.

The framework’s adaptability is further illustrated in S4 Fig, which shows the accuracy comparison between adaptive and non-adaptive models over a 15-day period. The adaptive model (blue line) maintains consistently high accuracy around 0.95 despite concept drift events (marked by red vertical lines), while the non-adaptive model (green line) shows significant performance degradation after each drift occurrence. This demonstrates the effectiveness of our self-learning mechanism in preserving model performance under evolving network conditions.

The superior performance can be attributed to several key factors:

1. The two-stage detection architecture effectively captures both general anomaly patterns and specific attack characteristics;
2. The integration of CNN-LSTM and LSTM-Transformer modules provides comprehensive feature analysis at multiple scales;
3. The self-learning mechanism enables rapid adaptation to emerging threats while maintaining detection accuracy.

Particularly noteworthy is the framework’s consistent performance across both datasets, demonstrating its robustness and generalization capability. The performance improvement is more pronounced in complex attack scenarios and zero-day attack detection, where the framework achieves a 92.8% detection rate for previously unseen attack patterns.

Model analysis

To comprehensively evaluate our framework’s design choices and component contributions, we conducted extensive ablation studies on both datasets. The ablation results, presented in Tables 6 and 7, demonstrate the significant contribution of each component to the framework’s overall performance.

Download:

• PPT
  PowerPoint slide
• PNG
  larger image
• TIFF
  original image

Table 6. Ablation study results on UNSW-NB15 dataset.

https://doi.org/10.1371/journal.pone.0332502.t006

Download:

• PPT
  PowerPoint slide
• PNG
  larger image
• TIFF
  original image

Table 7. Ablation study results on CICIDS2017 dataset.

https://doi.org/10.1371/journal.pone.0332502.t007

The ablation results illuminate the detection challenges that each component addresses and reveal why their combination proves necessary for comprehensive network anomaly detection. The base CNN-LSTM model achieves F1-scores of 0.9412 and 0.9385, establishing strong detection capability that encounters specific limitations when processing network traffic with distributed attack signatures.

Investigation of misclassified samples reveals that the base model struggles with attacks whose indicators appear across non-contiguous time windows. Consider an advanced persistent threat that establishes legitimate-appearing connections early in a session, maintains dormancy for hours, then exploits these connections for data exfiltration. The CNN-LSTM architecture processes traffic in sequential windows, making correlation of these temporally distant but functionally related events challenging.

The Transformer addition addresses this limitation directly, yielding improvements of 1.32% and 0.70% on the respective datasets. This gain magnitude reflects the Transformer’s role in handling the subset of attacks requiring global temporal correlation rather than replacing the CNN-LSTM’s local processing capabilities. Analysis of newly detected attacks shows that 89% involve multi-stage intrusions where attack indicators span extended time periods with normal traffic interspersed.

The self-learning mechanism produces the most substantial improvements—2.34% and 2.40%—by addressing the pervasive challenge of evolving attack patterns. Without adaptation, model performance degrades by an average of 8.7% over the evaluation period as attack tools and techniques evolve. The self-learning component not only prevents this degradation but enables continuous improvement through exposure to emerging threat patterns.

The integrated framework demonstrates how component interactions create detection capabilities that exceed simple additive combinations. Sequential processing creates synergy where CNN-LSTM output provides structured representations that facilitate Transformer attention computation. Raw traffic features would require the Transformer to simultaneously learn feature extraction and global correlation, reducing both efficiency and accuracy. The CNN-LSTM preprocessing enables the Transformer to focus on pattern correlation across temporal distances.

The self-learning mechanism enables dynamic component weighting based on current traffic characteristics. During periods dominated by local attack patterns, the system emphasizes CNN-LSTM contributions. When multi-stage attacks increase in frequency, Transformer influence grows proportionally. This adaptive weighting prevents over-reliance on any single component while maximizing the strengths of each.

Error recovery operates through the complementary nature of component limitations. CNN-LSTM excels at local pattern recognition but may miss distributed attack signatures. The Transformer captures global correlations but requires structured input to operate efficiently. Self-learning adapts both components to evolving threats but needs stable base detection to identify meaningful patterns. Each component compensates for the others’ constraints while amplifying their capabilities.

Different attack types reveal the specialized value of each component. Volume-based attacks like DDoS exhibit strong local signatures that CNN-LSTM detects with 96.2% accuracy. The Transformer contributes minimal improvement for these attacks since their indicators cluster temporally. Self-learning provides enhancement by adapting to evolving attack tools and amplification techniques. Stealth attacks present the opposite pattern, where advanced persistent threats achieve only 78.4% detection with CNN-LSTM alone, as these attacks deliberately distribute their signatures across time. The Transformer contributes substantial improvement by correlating these distributed indicators, while self-learning recognizes new stealth techniques as they emerge.

Zero-day attacks demonstrate the most variable performance, with CNN-LSTM achieving detection rates between 45-89% depending on similarity to known attack patterns. The Transformer provides moderate assistance through pattern generalization, but self-learning delivers the most significant improvement by rapidly incorporating new attack signatures into the detection model. This analysis demonstrates why each component addresses specific aspects of the network anomaly detection challenge and why their integration creates detection capabilities that no single component can achieve alone.

Discussion

The experimental results demonstrate both the capabilities and limitations of our proposed framework across different network environments and attack scenarios. Our evaluation on the UNSW-NB15 and CICIDS2017 datasets reveals significant improvements in detection accuracy, with F1-scores of 0.9778 and 0.9695 respectively, representing substantial advances over existing approaches. The framework’s ability to maintain such high performance levels across different network environments suggests robust generalization capabilities, particularly in handling complex attack patterns and previously unseen threats.

The 92.8% zero-day detection rate emerges from the framework’s multi-layered generalization capability and adaptive learning architecture. This performance was evaluated using unseen attack patterns that were temporally separated from training data, representing genuine zero-day scenarios where attack signatures are unavailable during model development.

The detection mechanism operates through three complementary pathways that address different aspects of zero-day threat identification. The CNN-LSTM foundation provides pattern generalization by learning abstract traffic representations that capture attack behaviors independent of specific implementation details. During training, the CNN layers learn to identify spatial correlations in traffic features that indicate malicious intent—such as anomalous packet size distributions, unusual protocol combinations, or irregular timing patterns. These learned representations enable detection of new attacks that exploit similar network vulnerabilities through different technical approaches.

The LSTM component contributes temporal generalization by modeling attack progression patterns that persist across different attack variants. Zero-day attacks often follow recognizable phases—reconnaissance, exploitation, and data exfiltration—even when specific techniques differ from known attacks. The LSTM’s memory mechanism captures these temporal signatures, enabling identification of attack sequences that follow familiar strategic patterns despite employing novel tactical approaches. The Transformer component provides the most sophisticated zero-day detection capability through its attention-based correlation of distant traffic events. Many advanced zero-day attacks employ distributed strategies where attack indicators appear across non-contiguous time periods to evade detection. The Transformer’s self-attention mechanism enables correlation of these distributed signatures, identifying attack patterns that span extended temporal ranges. This capability proves particularly valuable for detecting advanced persistent threats that establish legitimate-appearing connections before exploiting them for malicious purposes.

The self-learning mechanism enhances zero-day detection through continuous model refinement based on operational feedback. When the system encounters borderline cases where initial classification confidence is low, the multi-metric drift detection evaluates whether these cases represent genuine anomalies requiring investigation. Confirmed zero-day attacks trigger focused parameter updates that incorporate new attack signatures while preserving existing knowledge through Elastic Weight Consolidation. This creates an evolutionary learning process where the system’s zero-day detection capability improves through exposure to diverse threat patterns.

Compared to traditional approaches, our framework addresses fundamental limitations in zero-day detection methodologies. Signature-based systems fail completely against zero-day attacks due to their reliance on predefined attack patterns. Single-model anomaly detection systems, while capable of identifying novel patterns, typically generate excessive false positives that make operational deployment impractical. The CNN-LSTM baseline in our ablation study achieves 0.9412 F1-score, representing strong detection capability that nonetheless misses complex attacks requiring global temporal correlation.

Pure deep learning approaches without adaptive capabilities suffer from concept drift, where performance degrades as attack patterns evolve beyond the training distribution. Our self-learning mechanism directly addresses this limitation, enabling sustained performance against evolving zero-day threats. The 23.4-hour recovery time following drift detection demonstrates the system’s ability to rapidly incorporate new threat intelligence while maintaining operational effectiveness.

The framework’s zero-day detection capability also demonstrates robustness against adversarial evasion attempts. The multi-component architecture creates multiple detection pathways that attackers must simultaneously evade to avoid detection. An attack that successfully evades CNN-based spatial analysis may still be detected through LSTM temporal analysis or Transformer global correlation. This architectural redundancy, combined with continuous learning adaptation, creates a moving target that complicates adversarial attack development.

The two-stage detection architecture balances detection accuracy with computational efficiency through selective processing. Table 8 shows the framework processes 1250 samples per second for binary classification and 950 samples per second for attack classification, with memory usage of 2.8 GB and 3.5 GB respectively.

Download:

• PPT
  PowerPoint slide
• PNG
  larger image
• TIFF
  original image

Table 8. Computational efficiency analysis.

https://doi.org/10.1371/journal.pone.0332502.t008

The LSTM-Transformer component operates with complexity for self– attention and for LSTM processing, where T represents sequence length and d denotes feature dimensions. This complexity remains manageable because only 8-12% of network traffic typically requires the computationally intensive second-stage analysis. The CNN-LSTM stage filters traffic at line speed, reserving Transformer processing for suspected anomalous patterns.

The framework’s processing capacity suits typical network monitoring requirements. The two-stage design enables efficient resource utilization by applying intensive Transformer processing only to traffic requiring detailed analysis. High-throughput environments can maintain real-time performance through batch processing and GPU acceleration for the LSTM-Transformer component when needed.

Memory utilization scales linearly with batch size rather than sequence length, as both LSTM hidden states and attention weights operate within fixed window sizes. The framework maintains detection performance above 95% across different batch sizes, enabling flexible deployment based on available computational resources. Optimization techniques including attention pruning and weight quantization can reduce computational requirements by 20-30% and memory usage by 50% respectively, with minimal impact on detection accuracy.