Adaptive multi-view transformer ensemble for intrusion detection: Addressing data imbalance and enhancing attack classification

Network intrusion detection systems (IDS) face persistent challenges with imbalanced datasets, limited effectiveness against zero-day attacks, and inconsistent performance across diverse attack vectors. This paper presents the Adaptive Multi-View Transformer Ensemble for Intrusion Detection (AMTE-IDS), a comprehensive framework that addresses these limitations through innovative integration of advanced data balancing, multi-perspective feature learning, and dynamic ensemble classification. We introduce a Multi-Modal Wasserstein GAN with Gradient Penalty (MM-WGAN-GP) architecture employing multiple critics with complementary perspectives to generate high-quality synthetic samples for minority attack classes. Our Multi-View Feature Learning module extracts complementary representations of network traffic through specialized transformer-based pathways focusing on global features, temporal patterns, and protocol-specific characteristics. A Dynamic Ensemble Detection module adaptively combines specialized classifiers based on input characteristics, enabling effective detection across diverse attack vectors while maintaining robust performance against evolving threats. Extensive experimentation on NSL-KDD, UNSW-NB15, and CIC-IDS2017 datasets demonstrates that AMTE-IDS achieves 97.8% overall accuracy with 73.2% F1-score for minority classes, outperforming state-of-the-art MCGC-IDS by +0.9%/+2.4% respectively (p < 0.001), with 57.1% false positive rate reduction and 0.35ms per-sample inference latency confirming real-time deployment viability. The framework demonstrates strong generalization across different network environments and attack patterns, offering a promising approach for addressing the complex challenges of modern network security.