Document Type : Original/Review Paper
Authors
Department of Computer Engineering, University of Kashan, Kashan, Iran
Abstract
Detecting unknown cybersecurity attacks remains problematic because supervised learning cannot generalize to new threats quickly enough due to its reliance on previously trained models. The Self-Supervised TabTransformer with Energy-Based Open-Set Detection (SSTT-EBOD) framework uses self-supervised learning to improve performance when conducting anomaly de-tection using tabular datasets of network activity. This framework is particularly useful for identifying zero-day attacks in low-label enterprise network environments. Experimental evaluations using CIC-IDS2017 and UNSW-NB15 demonstrate that SSTT-EBOD outperforms TabNet, SAINT, and VIME+EBM across all perfor-mance metrics. For CIC-IDS2017, these metrics include an F1-score of 0.9621 and an OOD AUROC of 0.9451, and for UNSW-NB15, an F1-score of 0.938 and an OOD AUROC of 0.916. The novelty of SSTT-EBOD lies in its task-specific integration of es-tablished mechanisms for open-set network intrusion detection under limited labelled data, rather than in any individual compo-nent.
Keywords
Main Subjects
)