{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,6,4]],"date-time":"2026-06-04T15:55:06Z","timestamp":1780588506951,"version":"3.54.1"},"reference-count":54,"publisher":"MDPI AG","issue":"3","license":[{"start":{"date-parts":[[2025,8,6]],"date-time":"2025-08-06T00:00:00Z","timestamp":1754438400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["MAKE"],"abstract":"<jats:p>In this study, we introduce an enhanced hybrid Autoencoder\u2013Dense\u2013Transformer Neural Network (AE-DTNN) model for developing an effective intrusion detection system (IDS) aimed at improving the performance and robustness of threat detection strategies within a rapidly changing and increasingly complex network landscape. The Autoencoder component restructures network traffic data, while a stack of Dense layers performs feature extraction to generate more meaningful representations. The Transformer network then facilitates highly precise and comprehensive classification. Our strategy incorporates adaptive synthetic sampling (ADASYN) for both binary and multi-class classification tasks, complemented by the edited nearest neighbors (ENN) technique and the use of class weights to mitigate class imbalance issues. In experiments conducted on the NF-BoT-IoT-v2 dataset, the AE-DTNN-based IDS achieved outstanding performance, with 99.98% accuracy in binary classification and 98.30% in multi-class classification. On the NSL-KDD dataset, the model reached 98.57% accuracy for binary classification and 97.50% for multi-class classification. Additionally, the model attained 99.92% and 99.78% accuracy in binary and multi-class classification, respectively, on the CSE-CIC-IDS2018 dataset. These results demonstrate the exceptional effectiveness of the proposed model in contrast to conventional approaches, highlighting its strong potential to detect a broad range of network intrusions with high reliability.<\/jats:p>","DOI":"10.3390\/make7030078","type":"journal-article","created":{"date-parts":[[2025,8,6]],"date-time":"2025-08-06T15:09:53Z","timestamp":1754492993000},"page":"78","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":10,"title":["AE-DTNN: Autoencoder\u2013Dense\u2013Transformer Neural Network Model for Efficient Anomaly-Based Intrusion Detection Systems"],"prefix":"10.3390","volume":"7","author":[{"ORCID":"https:\/\/orcid.org\/0009-0009-1042-7503","authenticated-orcid":false,"given":"Hesham","family":"Kamal","sequence":"first","affiliation":[{"name":"Networks Department, Faculty of Information Engineering and Technology (IET), German University in Cairo (GUC), New Cairo 11835, Egypt"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-8313-5554","authenticated-orcid":false,"given":"Maggie","family":"Mashaly","sequence":"additional","affiliation":[{"name":"Networks Department, Faculty of Information Engineering and Technology (IET), German University in Cairo (GUC), New Cairo 11835, Egypt"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"1968","published-online":{"date-parts":[[2025,8,6]]},"reference":[{"key":"ref_1","doi-asserted-by":"crossref","unstructured":"Heady, R., Luger, G., Maccabe, A., and Servilla, M. (1990). The Architecture of a Network Level Intrusion Detection System, Technical Report.","DOI":"10.2172\/425295"},{"key":"ref_2","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1016\/j.comcom.2014.01.012","article-title":"A survey of intrusion detection in wireless network applications","volume":"42","author":"Mitchell","year":"2014","journal-title":"Comput. Commun."},{"key":"ref_3","doi-asserted-by":"crossref","first-page":"42","DOI":"10.1109\/MNET.2009.4804323","article-title":"A simple and efficient hidden Markov model scheme for host-based anomaly intrusion detection","volume":"23","author":"Hu","year":"2009","journal-title":"IEEE Netw."},{"key":"ref_4","first-page":"45","article-title":"Real-Time Intrusion Detection Using Deep Learning Techniques","volume":"140","author":"Zhang","year":"2020","journal-title":"J. Netw. Comput. Appl."},{"key":"ref_5","first-page":"101944","article-title":"A Review of Real-Time Intrusion Detection Systems Using Machine Learning Approaches","volume":"95","author":"Kumar","year":"2020","journal-title":"Comput. Secur."},{"key":"ref_6","first-page":"123","article-title":"Enhancing Network Security with Real-Time Intrusion Detection Systems","volume":"21","author":"Smith","year":"2021","journal-title":"Int. J. Inf. Secur."},{"key":"ref_7","doi-asserted-by":"crossref","unstructured":"Messinis, S., Temenos, N., Protonotarios, N.E., Rallis, I., Kalogeras, D., and Doulamis, N. (2024). Enhancing Internet of Medical Things security with artificial intelligence: A comprehensive review. Comput. Biol. Med., 170.","DOI":"10.1016\/j.compbiomed.2024.108036"},{"key":"ref_8","first-page":"222","article-title":"An intrusion-detection model","volume":"13","author":"Dorothy","year":"1987","journal-title":"IEEE Trans. Softw. Eng."},{"key":"ref_9","doi-asserted-by":"crossref","first-page":"350","DOI":"10.3390\/make4020015","article-title":"An attention-based ConvLSTM autoencoder with dynamic thresholding for unsupervised anomaly detection in multivariate time series","volume":"4","author":"Tayeh","year":"2022","journal-title":"Mach. Learn. Knowl. Extr."},{"key":"ref_10","doi-asserted-by":"crossref","first-page":"304","DOI":"10.3390\/make5010019","article-title":"A survey on gan techniques for data augmentation to address the imbalanced data issues in credit card fraud detection","volume":"5","author":"Strelcenia","year":"2023","journal-title":"Mach. Learn. Knowl. Extr."},{"key":"ref_11","doi-asserted-by":"crossref","first-page":"868","DOI":"10.3390\/make5030046","article-title":"Autoencoder Feature Residuals for Network Intrusion Detection: One-Class Pretraining for Improved Performance","volume":"5","author":"Lewandowski","year":"2023","journal-title":"Mach. Learn. Knowl. Extr."},{"key":"ref_12","first-page":"1","article-title":"Comparative analysis of perturbation techniques in LIME for intrusion detection enhancement","volume":"7","author":"Bacevicius","year":"2025","journal-title":"Mach. Learn. Knowl. Extr."},{"key":"ref_13","doi-asserted-by":"crossref","unstructured":"Wang, Y., Li, J., Zhao, W., Han, Z., Zhao, H., Wang, L., and He, X. (2023). N-STGAT: Spatio-temporal graph neural network based network intrusion detection for near-earth remote sensing. Remote Sens., 15.","DOI":"10.20944\/preprints202305.1455.v1"},{"key":"ref_14","doi-asserted-by":"crossref","first-page":"110495","DOI":"10.1016\/j.comnet.2024.110495","article-title":"Applying self-supervised learning to network intrusion detection for network flows with graph neural network","volume":"248","author":"Xu","year":"2024","journal-title":"Comput. Netw."},{"key":"ref_15","doi-asserted-by":"crossref","unstructured":"Kamal, H., and Mashaly, M. (2024). Advanced Hybrid Transformer-CNN Deep Learning Model for Effective Intrusion Detection Systems with Class Imbalance Mitigation Using Resampling Techniques. Future Internet, 16.","DOI":"10.3390\/fi16120481"},{"key":"ref_16","doi-asserted-by":"crossref","unstructured":"Yaras, S., and Dener, M. (2024). IoT-based intrusion detection system using new hybrid deep learning algorithm. Electronics, 13.","DOI":"10.3390\/electronics13061053"},{"key":"ref_17","doi-asserted-by":"crossref","first-page":"10611","DOI":"10.1007\/s11227-023-05073-x","article-title":"Addressing the class imbalance problem in network intrusion detection systems using data resampling and deep learning","volume":"79","author":"Abdelkhalek","year":"2023","journal-title":"J. Supercomput."},{"key":"ref_18","doi-asserted-by":"crossref","first-page":"465","DOI":"10.17798\/bitlisfen.1240469","article-title":"Analysis of intrusion detection systems in UNSW-NB15 and NSL-KDD datasets with machine learning algorithms","volume":"12","year":"2023","journal-title":"Bitlis Eren \u00dcniversitesi Fen Bilim. Dergisi."},{"key":"ref_19","doi-asserted-by":"crossref","unstructured":"Kamal, H., and Mashaly, M. (2025). Enhanced Hybrid Deep Learning Models-Based Anomaly Detection Method for Two-Stage Binary and Multi-Class Classification of Attacks in Intrusion Detection Systems. Algorithms, 18.","DOI":"10.3390\/a18020069"},{"key":"ref_20","doi-asserted-by":"crossref","first-page":"33","DOI":"10.1186\/s40537-024-00886-w","article-title":"Machine learning-based network intrusion detection for big and imbalanced data using oversampling, stacking feature embedding and feature extraction","volume":"11","author":"Talukder","year":"2024","journal-title":"J. Big Data"},{"key":"ref_21","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1080\/01969722.2023.2296246","article-title":"Performance evaluation and comparative analysis of machine learning models on the unsw-nb15 dataset: A contemporary approach to cyber threat detection","volume":"16","author":"Fathima","year":"2023","journal-title":"Cybern. Syst."},{"key":"ref_22","doi-asserted-by":"crossref","unstructured":"ElKashlan, M., Elsayed, M.S., Jurcut, A.D., and Azer, M. (2023). A machine learning-based intrusion detection system for IoT electric vehicle charging stations (EVCSs). Electronics, 12.","DOI":"10.3390\/electronics12041044"},{"key":"ref_23","doi-asserted-by":"crossref","unstructured":"Kamal, H., and Mashaly, M. (2025). Robust Intrusion Detection System Using an Improved Hybrid Deep Learning Model for Binary and Multi-Class Classification in IoT Networks. Technologies (2227-7080), 13.","DOI":"10.3390\/technologies13030102"},{"key":"ref_24","doi-asserted-by":"crossref","first-page":"3","DOI":"10.1007\/s10922-022-09691-3","article-title":"Cyber threat intelligence sharing scheme based on federated learning for network intrusion detection","volume":"31","author":"Sarhan","year":"2023","journal-title":"J. Netw. Syst. Manag."},{"key":"ref_25","doi-asserted-by":"crossref","first-page":"6430","DOI":"10.1109\/ACCESS.2021.3140015","article-title":"Generative deep learning to detect cyberattacks for the IoT-23 dataset","volume":"10","author":"Abdalgawad","year":"2021","journal-title":"IEEE Access"},{"key":"ref_26","doi-asserted-by":"crossref","unstructured":"Arapidis, E., Temenos, N., Giagkos, D., Rallis, I., Kalogeras, D., Papadakis, N., Litke, A., Messinis, C., and Zeekflow+, S. (2024, January 26\u201328). A Deep LSTM Autoencoder with Integrated Random Forest Classifier for Binary and Multi-class Classification in Network Traffic Data. Proceedings of the 17th International Conference on PErvasive Technologies Related to Assistive Environments, Crete, Greece.","DOI":"10.1145\/3652037.3663908"},{"key":"ref_27","doi-asserted-by":"crossref","first-page":"357","DOI":"10.1007\/s11036-021-01843-0","article-title":"Towards a standard feature set for network intrusion detection system datasets","volume":"27","author":"Sarhan","year":"2022","journal-title":"Mob. Netw. Appl."},{"key":"ref_28","unstructured":"Moustafa, N. (2025, June 21). Network Intrusion Detection System (NIDS) Datasets [Internet]. University of Queensland: Brisbane, Australia. Available online: https:\/\/staff.itee.uq.edu.au\/marius\/NIDS_datasets."},{"key":"ref_29","doi-asserted-by":"crossref","first-page":"6","DOI":"10.1186\/s40537-020-00390-x","article-title":"Resampling imbalanced data for network intrusion detection datasets","volume":"8","author":"Bagui","year":"2021","journal-title":"J. Big Data"},{"key":"ref_30","doi-asserted-by":"crossref","first-page":"919","DOI":"10.1111\/coin.12220","article-title":"Empirical study on multiclass classification-based network intrusion detection","volume":"35","author":"Elmasry","year":"2019","journal-title":"Comput. Intell."},{"key":"ref_31","first-page":"467","article-title":"Handling class imbalance problem in intrusion detection system based on deep learning","volume":"12","author":"Mbow","year":"2022","journal-title":"Int. J. Netw. Comput."},{"key":"ref_32","unstructured":"Goodfellow, I., Bengio, Y., and Courville, A. (2016). Deep Learning, MIT Press."},{"key":"ref_33","first-page":"5998","article-title":"Attention is all you need","volume":"30","author":"Vaswani","year":"2017","journal-title":"Adv. Neural Inf. Process. Syst."},{"key":"ref_34","unstructured":"Ba, J.L., Kiros, J.R., and Hinton, G.E. (2016). Layer normalization. arXiv."},{"key":"ref_35","doi-asserted-by":"crossref","unstructured":"Tavallaee, M., Bagheri, E., Lu, W., and Ghorbani, A.A. (2009, January 8\u201310). A detailed analysis of the KDD CUP 99 data set. Proceedings of the IEEE Symposium on Computational Intelligence for Security and Defense Applications, Ottawa, ON, Canada.","DOI":"10.1109\/CISDA.2009.5356528"},{"key":"ref_36","first-page":"446","article-title":"A study on NSL-KDD dataset for intrusion detection system based on classification algorithms","volume":"4","author":"Dhanabal","year":"2015","journal-title":"Int. J. Adv. Res. Comput. Commun. Eng."},{"key":"ref_37","unstructured":"Sharafaldin, I., Lashkari, A.H., and Ghorbani, A.A. (2025, June 21). CSE-CIC-IDS2018 Dataset. Fredericton (NB): Canadian Institute for Cybersecurity, University of New Brunswick; 2018. Available online: https:\/\/www.unb.ca\/cic\/datasets\/ids-2018.html."},{"key":"ref_38","doi-asserted-by":"crossref","unstructured":"Songma, S., Sathuphan, T., and Pamutha, T. (2023). Optimizing intrusion detection systems in three phases on the CSE-CIC-IDS-2018 dataset. Computers, 12.","DOI":"10.3390\/computers12120245"},{"key":"ref_39","first-page":"4824","article-title":"Global climate prediction using deep learning","volume":"100","year":"2022","journal-title":"J. Theor. Appl. Inf. Technol."},{"key":"ref_40","doi-asserted-by":"crossref","first-page":"101976","DOI":"10.1016\/j.phycom.2022.101976","article-title":"Deep learning-driven MIMO: Data encoding and processing mechanism","volume":"57","author":"Song","year":"2023","journal-title":"Phys. Commun."},{"key":"ref_41","doi-asserted-by":"crossref","unstructured":"Zhou, X., Zhao, C., Sun, J., Yao, K., and Xu, M. (2023). Detection of lead content in oilseed rape leaves and roots based on deep transfer learning and hyperspectral imaging technology. Spectrochim. Acta Part A Mol. Biomol. Spectrosc., 290.","DOI":"10.1016\/j.saa.2022.122288"},{"key":"ref_42","doi-asserted-by":"crossref","first-page":"2278","DOI":"10.1109\/5.726791","article-title":"Gradient-based learning applied to document recognition","volume":"86","author":"LeCun","year":"2002","journal-title":"Proc. IEEE"},{"key":"ref_43","doi-asserted-by":"crossref","unstructured":"Kunang, Y.N., Nurmaini, S., Stiawan, D., and Zarkasi, A. (2018, January 2\u20134). Automatic features extraction using autoencoder in intrusion detection system. Proceedings of the International Conference on Electrical Engineering and Computer Science (ICECOS), Pangkal Pinang, Indonesia.","DOI":"10.1109\/ICECOS.2018.8605181"},{"key":"ref_44","doi-asserted-by":"crossref","first-page":"1723","DOI":"10.1007\/s11063-018-9894-5","article-title":"Discriminative autoencoder for feature extraction: Application to character recognition","volume":"49","author":"Gogna","year":"2019","journal-title":"Neural Process. Lett."},{"key":"ref_45","first-page":"3632943","article-title":"Stacked denoise autoencoder based feature extraction and classification for hyperspectral images","volume":"2016","author":"Chen","year":"2016","journal-title":"J. Sens."},{"key":"ref_46","doi-asserted-by":"crossref","unstructured":"Michelucci, U. (2022). An introduction to autoencoders. arXiv.","DOI":"10.1007\/978-1-4842-8020-1_9"},{"key":"ref_47","unstructured":"Dosovitskiy, A., Beyer, L., Kolesnikov, A., Weissenborn, D., Zhai, X., Unterthiner, T., Dehghani, M., Minderer, M., Heigold, G., and Gelly, S. (2020). An image is worth 16x16 words: Transformers for image recognition at scale. arXiv."},{"key":"ref_48","unstructured":"Alexandrov, A.A. (2019). Anomaly-based intrusion detection system. Anomaly Detection and Complex Network System, IntechOpen."},{"key":"ref_49","doi-asserted-by":"crossref","unstructured":"Chen, C., Song, Y., Yue, S., Xu, X., Zhou, L., Lv, Q., and Yang, L. (2022). Fcnn-se: An intrusion detection model based on a fusion CNN and stacked ensemble. Appl. Sci., 12.","DOI":"10.3390\/app12178601"},{"key":"ref_50","unstructured":"Powers, D.M. (2020). Evaluation: From precision, recall and F-measure to ROC, informedness, markedness and correlation. arXiv."},{"key":"ref_51","doi-asserted-by":"crossref","unstructured":"Kamal, H., and Mashaly, M. (2024, January 19\u201321). Improving Anomaly Detection in IDS with Hybrid Auto Encoder-SVM and Auto Encoder-LSTM Models Using Resampling Methods. Proceedings of the 6th Novel Intelligent and Leading Emerging Sciences Conference (NILES), Giza, Egypt.","DOI":"10.1109\/NILES63360.2024.10753149"},{"key":"ref_52","doi-asserted-by":"crossref","first-page":"78","DOI":"10.1016\/j.procs.2023.03.013","article-title":"Anomaly-based intrusion detection system using one-dimensional convolutional neural network","volume":"220","author":"Assy","year":"2023","journal-title":"Procedia Comput. Sci."},{"key":"ref_53","doi-asserted-by":"crossref","unstructured":"Kamal, H., and Mashaly, M. (2025, January 12\u201315). Hybrid Deep Learning-Based Autoencoder-DNN Model for Intelligent Intrusion Detection System in IoT Networks. Proceedings of the 15th International Conference on Electrical Engineering (ICEENG), Cairo, Egypt.","DOI":"10.1109\/ICEENG64546.2025.11031372"},{"key":"ref_54","doi-asserted-by":"crossref","unstructured":"Kamal, H., and Mashaly, M. (2025). Combined Dataset System Based on a Hybrid PCA\u2013Transformer Model for Effective Intrusion Detection Systems. AI, 6.","DOI":"10.3390\/ai6080168"}],"container-title":["Machine Learning and Knowledge Extraction"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/2504-4990\/7\/3\/78\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,9]],"date-time":"2025-10-09T18:24:58Z","timestamp":1760034298000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/2504-4990\/7\/3\/78"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,8,6]]},"references-count":54,"journal-issue":{"issue":"3","published-online":{"date-parts":[[2025,9]]}},"alternative-id":["make7030078"],"URL":"https:\/\/doi.org\/10.3390\/make7030078","relation":{},"ISSN":["2504-4990"],"issn-type":[{"value":"2504-4990","type":"electronic"}],"subject":[],"published":{"date-parts":[[2025,8,6]]}}}