2.1 Definition of anomaly detection metrics

The performance of a NTAD system is evaluated using a combination of metrics that assess its capability to correctly identify threats while minimizing false alarms. Given that our proposed model functions as a Single-Input-Single-Output (SISO) regressor predicting a continuous anomaly score, evaluation occurs at two levels: 1) Regression performance on the raw score, and 2) Classification performance after applying a threshold to convert the score into a binary decision, as shown in Fig 1.

Download:

• PNG
  larger image
• TIFF
  original image

Fig 1. Schematic diagram of the dual-level evaluation mechanism for the SISO regressor-based NTAD system.

https://doi.org/10.1371/journal.pone.0341920.g001

Let be the ground-truth anomaly score (where 0 typically represents “normal” and higher values indicate severity or different anomaly types) and be the model’s predicted score. For binary classification, a threshold is applied: , where is the indicator function. Based on the binary predictions, we define the following confusion matrix quantities: True Positives (TP), False Positives (FP), True Negatives (TN), and False Negatives (FN).

2.2 Model performance evaluation metrics

To comprehensively evaluate the proposed model, we adopt a hybrid assessment framework encompassing both regression accuracy and classification efficacy. Since the model outputs a continuous anomaly score that is subsequently thresholded to yield a binary decision (normal vs. anomalous), this dual-perspective evaluation is indispensable: regression metrics quantify the precision of the predicted score, while classification metrics assess the quality of the resulting alert. Let denote the ground-truth target for the i-th sample—interpreted as a continuous anomaly score for regression and as a binary label 0,1 for classification—and let denote the corresponding model prediction. Given N evaluation samples and a predefined threshold , the binary prediction is obtained as , where is the indicator function.

2.2.1 Regression performance metrics.

These metrics quantify the accuracy of the continuous anomaly score prediction [48].

1. a). Mean Absolute Error (MAE)

The MAE measures the average magnitude of absolute errors between the predicted and true scores, providing a linear and interpretable measure of deviation.

(1)

where N is the total number of samples in the evaluation dataset. is the ground-truth (actual) continuous anomaly score for the i-th sample. is the predicted continuous anomaly score for the i-th sample generated by the model. denotes the absolute value operator.

1. b). Root Mean Square Error (RMSE)

(2)

1. c). Coefficient of Determination

(3)(4)(5)

where is the residual sum of squares, representing the total variance unexplained by the model. S S tot is the total sum of squares, representing the total variance in the observed ground-truth data. is the arithmetic mean of all ground-truth scores, defined as .

2.2.2 Classification performance metric.

The classification metrics are derived by applying a threshold to the continuous predictions to obtain binary decisions, which are then compared against the ground-truth binary labels. The counts of True Positives (TP), False Positives (FP), True Negatives (TN), and False Negatives (FN) are obtained from this comparison [49].

1. d). F1-Score

(6)

where Precision (positive predictive value) is defined as . Recall (sensitivity or true positive rate) is defined as . TP (True Positives) is the number of anomalous samples correctly identified as anomalous. FP is the number of normal samples incorrectly identified as anomalous. FN is the number of anomalous samples incorrectly identified as normal.

2.3 SISO model framework for traffic anomaly prediction

This section formalizes the core prediction problem as a Single-Input Single-Output (SISO) supervised time-series regression task [50]. The objective is to learn a direct mapping from a historical window of preprocessed traffic to an anomaly score at the immediate future time step, thereby enabling proactive threat identification. The framework rests on the premise that network traffic evolution, including anomaly onset, exhibits discernible temporal dependencies: the traffic state at t + 1 is conditionally dependent on its behavior within a preceding window of length T. This formulation permits the model to exploit recent contextual information for forecasting impending deviations, such as abrupt surges or declines in traffic volume. The complete mathematical construction is detailed below.

1. Step 1: Preprocessed Traffic Sequence

The raw, non-stationary network traffic signal is first decomposed, denoised, and normalized via the EMD-based pipeline. The output is a clean, normalized univariate time series.

(7)

where represents the normalized, denoised traffic value at discrete time step t. N is the total length of the preprocessed time series. The subscript t indexes the chronological order of the data points.

1. Step 2: Construction of the Sliding Input Window (Model Input)

For any given time step , the model’s input is constructed by extracting the most recent T values from the preprocessed series, forming a fixed-length historical context window.

(8)

where is the model input vector at prediction time t. T is the predefined look-back window size or sequence length, a critical hyperparameter that determines the temporal context available to the model. The notation denotes a column vector of dimension T.

1. Step 3: Definition of the Prediction Target (Model Output)

The objective of the model is to predict the network’s state at the next immediate time step t + 1. This state is represented by a continuous anomaly score.

(9)

where is the ground-truth target value for time t + 1. In a regression setting, this can be a direct normalized traffic value for one-step-ahead forecasting (), or a specifically crafted continuous score indicating the severity or likelihood of an anomaly.

1. Step 4: The SISO Prediction Function

The core of the framework is a parameterized function (the deep learning model) that learns the mapping from the historical input window to the future target.

(10)

where represents the non-linear mapping function of the proposed hybrid Transformer-BiLSTM model. denotes the complete set of all trainable parameters (weights and biases) within the model. is the predicted output (anomaly score) for time t + 1.

1. Step 5: Learning Objective (Loss Function)

The model is trained by adjusting its parameters to minimize the difference between its predictions and the ground truth across all training samples. A common objective for regression is the MSE.

(11)

where is the loss function to be minimized. M is the total number of training samples (), as each sample requires T previous points. The index k iterates over the training samples constructed via the sliding window.

1. Step 6: Binary Decision via Thresholding

For operational deployment, the continuous anomaly score is converted into a binary alert (Normal vs. Anomalous) by comparing it to a user-defined threshold .

(12)

where is the indicator function. is the decision threshold, which can be tuned to balance the trade-off between the detection rate (Recall) and the false alarm rate FPR.

The following Table 1 summarizes the key components and variables of the proposed SISO framework for clarity.

Download:

• PNG
  larger image
• TIFF
  original image

Table 1. Summary of Notation for the SISO Prediction Framework.

https://doi.org/10.1371/journal.pone.0341920.t001

This SISO formulation provides a focused and effective paradigm for real-time anomaly prediction. By concentrating the model’s capacity on learning the precise relationship between a localized temporal pattern and its immediate consequence, it is particularly adept at detecting abrupt changes indicative of cyber threats, while maintaining low computational latency suitable for online monitoring systems.

2.4 Data preprocessing with empirical mode decomposition

Raw network traffic time series exhibit significant non-stationarity and non-linearity and are often contaminated with noise, which directly impacts the prediction accuracy and stability of subsequent deep learning models. To extract its essential characteristics and suppress noise, this work introduces EMD as a fully data-driven, adaptive signal preprocessing technique [51]. The core idea of EMD is to decompose a complex signal into a finite set of Intrinsic Mode Functions (IMFs) with distinct temporal scales and a final Residue, thereby progressively separating oscillations and trends embedded within the original signal [52].

2.4.1 Definition of an Intrinsic Mode Function (IMF).

A valid IMF must satisfy the following two conditions to ensure its instantaneous frequency has physical meaning:

1. Balance between Extrema and Zero Crossings: Throughout the entire data sequence, the number of extrema (both local maxima and minima) and the number of zero crossings must either be equal or differ at most by one.
2. Local Symmetry of Envelopes: At any point in time, the mean value of the upper envelope (defined by the local maxima) and the lower envelope (defined by the local minima) must be zero.

Mathematically, for a candidate function c(t) to be an IMF, let e_max (t) and e_min (t) represent its upper and lower envelopes, respectively. The condition requires:

(13)

2.4.2 The Sifting Process.

The core algorithm of EMD is an iterative sifting process designed to extract IMFs from a signal s(t). The process for obtaining the k-th IMF, denoted as , from the residual signal (initially r₀(t)=s(t)) is described as follows and illustrated in Fig 2.

Download:

• PNG
  larger image
• TIFF
  original image

Fig 2. Flowchart of the EMD sifting process for extracting a single IMF.

https://doi.org/10.1371/journal.pone.0341920.g002

Step-by-step Mathematical Formulation:

1. a). Initialization: Start with the current residue. For the first IMF, , where k is the IMF index starting from 1, and the iteration index j is initialized to 0.
2. b). Identify Extrema: Find all local maxima and minima in the current signal .
3. c). Construct Envelopes: Interpolate all local maxima and minima separately using cubic spline interpolation to form the upper envelope and the lower envelope .
4. d). Calculate Mean Envelope: Compute the local mean envelope :(14)
5. e). Extract Candidate Component: Subtract the mean envelope from the current signal to obtain a refined candidate:(15)
6. f). Check Stopping Criterion: Determine whether satisfies the IMF conditions. The sifting process for IMF k stops when the Standard Deviation (SD) between and falls below a pre-defined threshold :(16)
   If the criterion is not met, set j = j + 1 and repeat steps a-f.
7. g). Assign IMF and Update Residue: Once the stopping criterion is met, the k-th IMF is defined as . The residue for the next extraction stage is then updated:(17)
   The overall EMD decomposition is complete when the final residue becomes a monotonic function The original signal s(t) can thus be perfectly reconstructed as the sum of all IMFs and the final residue:(18)

2.4.3 Application to network traffic data.

The EMD output is utilized for denoising and feature enhancement. To objectively distinguish signal-dominant IMFs from noise-dominant components, we employ the Pearson correlation coefficient criterion. Let x(t) denote the original traffic sequence and the k-th IMF. The correlation coefficient between each IMF and the original signal is computed. An IMF is classified as signal-bearing if , where the threshold is defined as with . IMFs failing this criterion are regarded as noise-dominant and are discarded prior to reconstruction. The denoised signal is then obtained by summing the retained IMFs and the final residue:

(19)

The resulting components possess distinct physical interpretations pertinent to network analysis:

• High-frequency IMFs: Typically capture noise, short-term bursts, and very fine-grained fluctuations in traffic.
• Medium-frequency IMFs: Represent the core rhythmic components and main oscillatory modes of the traffic, often corresponding to regular periodic patterns (e.g., diurnal cycles).
• Low-frequency IMFs and the Residue: Characterize the long-term trend and very slow variations in the traffic baseline.

The EMD output is utilized for denoising and feature enhancement through the following pipeline, summarized in Table 2:

Download:

• PNG
  larger image
• TIFF
  original image

Table 2. EMD-based preprocessing pipeline for network traffic data.

https://doi.org/10.1371/journal.pone.0341920.t002

By transforming the raw, non-stationary traffic series x(t) into the denoised, normalized, and sequentially structured data , the EMD preprocessing stage provides a refined input that enables the subsequent Transformer-BiLSTM model to more effectively learn the underlying temporal dynamics and anomalous patterns.

3.1 Model architecture

The architecture, depicted in Fig 3, processes the input window through a series of components to produce the final anomaly score.

Download:

• PNG
  larger image
• TIFF
  original image

Fig 3. Architecture of the proposed FA-optimized Transformer-BiLSTM model.

https://doi.org/10.1371/journal.pone.0341920.g003

3.1.1 Transformer encoder component.

The Transformer encoder constitutes the first stage of the hybrid architecture and is responsible for capturing global, long-range dependencies across the preprocessed traffic sequence. In contrast to recurrent networks that process inputs sequentially, the Transformer employs a self-attention mechanism to simultaneously compute pairwise relationships among all time steps within the input window. Given a normalized input sequence , where T denotes the look-back window length, the scalar values are first projected into a dmodel-dimensional space via a learnable linear embedding:

(20)

where is the embedded sequence. Since the self-attention mechanism is permutation-invariant, positional encoding (PE) is added to inject information about the temporal order of the sequence.

We use the sinusoidal encoding defined:

(21)(22)

where pos is the position (time step index) and i is the dimension index. The resulting tensor serves as the input to the encoder stack.

The core of the encoder is the Multi-Head Self-Attention (MHSA) layer. For each attention head h, the input Z is linearly projected into distinct , Key (K), and Value (V) matrices:

(23)

where and is the dimensionality per head for H total heads. The Scaled Dot-Product Attention for head h is computed as:

(24)

Here, M is an optional mask matrix (e.g., for preventing attention to future time steps in a decoder; in this encoder-only setup, it is typically omitted). The scaling factor mitigates the vanishing gradient problem associated with the softmax function for large . The outputs from all H heads are concatenated and linearly projected:

(25)

Each MHSA layer is followed by a position-wise Feed-Forward Network (FFN), which consists of two linear transformations with a ReLU activation in between, applied identically to each time step:

(26)

where , and is the inner layer dimensionality.

A residual connection followed by Layer Normalization (LayerNorm) is applied around both the MHSA and FFN sub-layers. For an input Z to a sub-layer function F, the output is:

(27)

This structure, repeated over N encoder layers, progressively refines the sequence representation. The final output of the Transformer encoder is a contextually enriched sequence , where each time step’s representation incorporates weighted information from all other time steps in the window.

3.1.2 BiLSTM network component.

The Bidirectional LSTM (BiLSTM) network [41] serves as the second stage, refining the Transformer output by capturing bidirectional temporal dependencies. Processing the sequence in both forward () and backward () directions, the forward pass at time step j employs the standard gating computations:

1. a) Forget Gate : Decides what information to discard from the cell state.(28)
2. b) Input Gate (): Decides what new information to store in the cell state.(29)
3. c) Candidate Cell State (): Creates a vector of new candidate values.(30)
4. d) Cell State Update: The old cell state is updated to the new cell state .(31)
5. e) Output Gate (): Decides what part of the cell state to output.(32)
6. f) Hidden State Output: The final hidden state for time step j is computed.(33)

In these equations, is the j-th time step of denotes the sigmoid activation function, ⊙ denotes the Hadamard (element-wise) product, and are learnable weights and biases. The backward LSTM performs identical calculations but processes the sequence in reverse order (from j = T to j = 1).

The final output of the BiLSTM layer for each time step j is the concatenation of the forward and backward hidden states:

(34)

where d_lstm is the number of units in each unidirectional LSTM. This bidirectional context is crucial for tasks like anomaly detection, where an event’s significance often depends on surrounding context in both temporal directions.

3.1.3 Output regression layer.

The Output Regression Layer maps the BiLSTM’s bidirectional features to a continuous anomaly score . Temporal aggregation is typically performed by taking the final hidden state , which encapsulates condensed information from the entire sequence.

(35)

Alternatively, attention pooling may be employed to learn a weighted combination of all hidden states. The aggregated vector is subsequently passed through one or more fully connected layers with nonlinear activations for high-level feature integration and dimensionality reduction:

(36)(37)

where W₁, W₂ are weight matrices and are bias vectors. Dropout layers are applied after each activation during training to prevent overfitting.

Finally, a linear output layer projects the last hidden activation to the predicted anomaly score:

(38)

Here, is the output of the last dense layer, is the output weight vector, and is the output bias. This SISO regression output represents the model’s predicted likelihood or severity of an anomaly occurring at the next time step t + 1. For operational use, this score can be compared against a tunable threshold to generate a binary classification decision. The entire network is trained end-to-end by minimizing a regression loss function, such as the MSE, between the predicted and true anomaly scores.

3.2 Hyperparameter optimization using Firefly Algorithm

The performance of the proposed Transformer-BiLSTM hybrid architecture is highly sensitive to the configuration of its hyperparameters. Manual tuning is impractical due to the vast, complex search space and the high computational cost of evaluating each configuration. To address this, we employ the Firefly Algorithm (FA) [53], a nature-inspired metaheuristic optimization algorithm, to automatically and efficiently identify a near-optimal hyperparameter set.

3.2.2 Formulation of the FA for hyperparameter optimization.

In our framework, each firefly i represents a candidate hyperparameter vector in the search space. The brightness of a firefly is inversely related to the objective function value , which is the validation loss obtained after training the Transformer-BiLSTM model with hyperparameters for a limited number of epochs E_fast. We define brightness as:

(39)

A lower validation loss thus yields higher brightness.

The attractiveness between two fireflies i and j is a function of their Cartesian distance and decreases monotonically with distance:

(40)

Here, is the attractiveness at zero distance (typically ), and is the light absorption coefficient, controlling the rate at which attractiveness diminishes.

The Cartesian distance between fireflies i and j in the normalized hyperparameter space is computed as:

(41)

where D is the dimensionality of the hyperparameter space, and and are the lower and upper bounds for the d-th hyperparameter, respectively. Normalization ensures all hyperparameters contribute equally to the distance measure.

The movement of a firefly i that is attracted to a brighter firefly j is governed by the following update rule:

(42)

The second term represents the attraction force, pulling firefly i towards j. The third term is a randomization component, where is a randomization parameter (typically ) and is a vector of random numbers drawn from a uniform distribution . This random walk helps prevent premature convergence to local optima and encourages exploration of the search space. If firefly i is the brightest in its neighborhood, it performs a random walk by omitting the attraction term:

(43)

3.2.3 Hyperparameter search space and fitness evaluation.

The FA optimizes a set of critical hyperparameters for the Transformer-BiLSTM model, as defined in Table 3. The search space is carefully designed to balance expressiveness and computational feasibility.

Download:

• PNG
  larger image
• TIFF
  original image

Table 3. Hyperparameter Search Space for Firefly Algorithm Optimization.

https://doi.org/10.1371/journal.pone.0341920.t003

The fitness evaluation for a candidate hyperparameter set is the core of the optimization loop and is detailed as follows:

1. 1). Model Construction: Instantiate a Transformer-BiLSTM model using the hyperparameters in .
2. 2). Fast Training: Train the model on the training set for a reduced number of epochs E fast using the specified learning rate . This is a computationally efficient proxy for full training.
3. 3). Validation Loss Calculation: Evaluate the trained model on the held-out validation set to compute the primary objective, the RMSE:(44)

4.1 Experimental setup and baseline models

To rigorously evaluate the proposed EMD-FA-Transformer-BiLSTM framework, we conducted a comprehensive set of experiments under a unified simulation environment. All models were implemented in Python 3.9 with PyTorch 1.12 and trained on an NVIDIA RTX 3090 GPU. The benchmark network traffic dataset was partitioned chronologically into 70% training, 15% validation, and 15% testing subsets to preserve temporal causality. The raw nonstationary traffic volume sequences were first preprocessed using Empirical Mode Decomposition, with the first five intrinsic mode functions retained to denoise the signal while preserving essential fluctuation patterns.

For a fair comparison, we included three categories of baseline models:

1. Simple recurrent models: vanilla LSTM and GRU;
2. Optimized variants: FA-LSTM (LSTM with hyperparameters tuned by the Firefly Algorithm) and PSO-BiLSTM;
3. State-of-the-art sequence models: standard Transformer encoder, Informer, Temporal Convolutional Network (TCN), and bidirectional GRU (BiGRU).

All deep learning models were trained for a maximum of 100 epochs using the Adam optimizer with a batch size of 64. Early stopping with a patience of 10 epochs was applied to prevent overfitting. The hyperparameters of the proposed model were automatically optimized via the Firefly Algorithm, while the competing models were either tuned via grid search or adopted recommended settings from their original publications.

4.2 Simulation result

The simulation diagram of the prediction model proposed in this paper can be seen in Fig 4 to Fig 14. Fig 4 presents the training-set predictions, where the proposed FA-Transformer-BiLSTM model exhibits near-perfect alignment with the ground-truth trajectory, maintaining residuals confined within ±10 units—approximately half the error magnitude observed for the baseline LSTM and FA-LSTM. This superior fitting capability is further corroborated on unseen test data (Fig 5), where the proposed model sustains a tight residual band of ±8 units, in stark contrast to the ±20–30 unit deviations exhibited by competing methods, thereby demonstrating robust generalization. Quantitative comparisons on the training set (Fig 6) reveal that the proposed model reduces MSE, MAE, and RMSE by approximately 40%, 35%, and 38%, respectively, relative to the best-performing alternative, underscoring the efficacy of the attention-based feature refinement prior to bidirectional sequence modeling. On the test set (Fig 7), these margins widen further: the proposed model achieves reductions of 45% (MSE), 42% (MAE), and 44% (RMSE) compared to FA-LSTM, and exceeds 55% improvement over the vanilla LSTM, confirming the transferability of the learned representations. Fig 8 assesses overfitting through train–test performance divergence; the proposed model exhibits only a 2% degradation in error metrics and maintains a correlation coefficient of ≈0.98 and an R² of ≈0.96, whereas competing models suffer 6–8% performance drops, indicating effective noise filtering rather than memorization. Error distribution analysis (Fig 9) further reveals a sharply peaked, light-tailed residual histogram for the proposed model, with box-plot whiskers spanning less than one-third of the rivals’ range—a desirable property for reliable operational forecasting. Finally, Fig 10 evaluates anomaly detection performance: the proposed model attains the highest F₁-score (≈0.86) with balanced precision and recall, and maintains this advantage across varying decision thresholds while exhibiting the smallest train–test F₁ discrepancy (≈0.03), thereby confirming its consistency in both regression and classification regimes.

Download:

• PNG
  larger image
• TIFF
  original image

Fig 4. Comparison of prediction results and errors on the training set.

https://doi.org/10.1371/journal.pone.0341920.g004

Download:

• PNG
  larger image
• TIFF
  original image

Fig 5. Comparison of prediction results and errors on the test set.

https://doi.org/10.1371/journal.pone.0341920.g005

Download:

• PNG
  larger image
• TIFF
  original image

Fig 6. Comparison of performance metrics (MSE/MAE/RMSE) on the training set.

https://doi.org/10.1371/journal.pone.0341920.g006

Download:

• PNG
  larger image
• TIFF
  original image

Fig 7. Comparison of performance metrics (MSE/MAE/RMSE) on the test set.

https://doi.org/10.1371/journal.pone.0341920.g007

Download:

• PNG
  larger image
• TIFF
  original image

Fig 8. Comprehensive performance comparison (training set vs. test set).

https://doi.org/10.1371/journal.pone.0341920.g008

Download:

• PNG
  larger image
• TIFF
  original image

Fig 9. Comparison of error distribution (histogram and box plot).

https://doi.org/10.1371/journal.pone.0341920.g009

Download:

• PNG
  larger image
• TIFF
  original image

Fig 10. Comparative Analysis of F1 Scores for Network Traffic Anomaly Detection Models.

https://doi.org/10.1371/journal.pone.0341920.g010

Download:

• PNG
  larger image
• TIFF
  original image

Fig 11. Ablation study results showing the impact of each component (EMD, Transformer, BiLSTM, FA) on (a) F1-score and (b) RMSE.

https://doi.org/10.1371/journal.pone.0341920.g011

Download:

• PNG
  larger image
• TIFF
  original image

Fig 12. Performance comparison with state-of-the-art baseline models on the test set:

(a) F1-score and (b) RMSE.

https://doi.org/10.1371/journal.pone.0341920.g012

Download:

• PNG
  larger image
• TIFF
  original image

Fig 13. Overfitting analysis: scatter plot of training versus testing F1-scores for multiple models.

Each point represents a single run, with 95% confidence ellipses drawn around the cluster mean. The dashed diagonal line indicates perfect generalization, while the shaded band represents acceptable performance drop (<0.03).

https://doi.org/10.1371/journal.pone.0341920.g013

Download:

• PNG
  larger image
• TIFF
  original image

Fig 14. Statistical significance heatmap summarizing p-values (Proposed vs. baselines) across five evaluation metrics.

https://doi.org/10.1371/journal.pone.0341920.g014

While the preceding results demonstrate the empirical superiority of the proposed EMD-FA-Transformer-BiLSTM model in terms of predictive accuracy and anomaly detection performance, a rigorous assessment must further address several critical aspects raised during peer review: the statistical significance of observed improvements, the contribution of individual model components, and the robustness of conclusions against stronger state-of-the-art baselines. To this end, we augment the simulation study with a comprehensive suite of supplementary analyses—encompassing an ablation study, benchmarking against advanced contemporary models, an overfitting diagnosis, and a statistical significance heatmap. The corresponding findings are presented in Figs 11 through 14 and discussed in detail below.

Fig 11 systematically dissects the contribution of each architectural and preprocessing module through an ablation study. Five model variants are evaluated over ten independent runs, with mean F1-score and RMSE reported alongside standard deviation error bars. The full model achieves an F1-score of 0.86 ± 0.02 and an RMSE of 8.2 ± 0.5. Removing EMD preprocessing incurs the most severe performance penalty, reducing F1-score by 8.1% and increasing RMSE by 52.4%, thereby confirming the indispensability of adaptive signal denoising for non-stationary traffic data. The Transformer encoder and BiLSTM layer exhibit complementary roles, with their respective removal causing F1-score declines of 5.6% and 9.3%. Notably, substituting Firefly Algorithm optimization with manual grid search yields a moderate yet statistically significant degradation (p < 0.05), validating the efficacy of automated hyperparameter tuning. Fig 12 extends the comparative evaluation to include state-of-the-art sequence models such as Informer, TCN, and BiGRU. The proposed model outperforms all competitors across both classification and regression metrics, achieving a 6.2% relative improvement in F1-score over the standard Transformer and a 7.5% improvement over Informer. Error bars representing 95% confidence intervals confirm that the performance margins are statistically robust.

Fig 13 addresses concerns regarding potential overfitting by juxtaposing training and testing F1-scores across multiple runs for all evaluated models. Each model’s run cluster is encapsulated by a 95% confidence ellipse, with the diagonal dashed line demarcating perfect generalization. The proposed model’s cluster resides tightly within the shaded generalization band, exhibiting a mean train–test F1 discrepancy of merely 0.02, whereas competing models—particularly the standard LSTM and Transformer—display substantially wider gaps (0.04–0.06) and greater inter-run variance. This behavior corroborates the regularizing effect of EMD-based denoising and the hybrid attention-recurrent design. Finally, Fig 14 consolidates the statistical significance analysis into a compact heatmap representation. Pairwise p-values are computed between the proposed model and each baseline across five key metrics (F1-score, Precision, Recall, RMSE, MAE). Darker cells correspond to stronger significance levels. The proposed model achieves p < 0.01 for nearly all comparisons, with RMSE and MAE differences uniformly significant at p < 0.001. These results provide rigorous statistical evidence that the observed performance gains are not attributable to random variation, thereby reinforcing the validity of the proposed framework.