Comparative Study of Transformer-based Architecture and CNN-LSTM Hybrid Model for Network Intrusion Detection Using CSE-CIC-IDS 2018 Dataset

Network intrusion detection systems (NIDS) are critical for protecting modern network infrastructures from sophisticated cyber threats. This study presents a comprehensive comparative analysis of two advanced deep learning architectures: a pure Transformer-based model and a hybrid Convolutional Neural Network-Long Short-Term Memory (CNN-LSTM) model for multi-class intrusion detection. Using the preprocessed and balanced CSE-CIC-IDS 2018 dataset (Version 1, 2024), we evaluate both models across multiple performance metrics. The dataset underwent rigorous preprocessing including duplicate removal, feature engineering, and two-stage resampling (Random Undersampling and SMOTE) to address class imbalance. Our experimental results demonstrate that the Transformer model achieves 99.42% accuracy with a ROC-AUC of 99.58%, while the CNN-LSTM hybrid model achieves 99.18% accuracy with a ROC-AUC of 99.35%. The Transformer architecture excels in capturing long-range dependencies and parallel processing, while CNN-LSTM effectively combines spatial feature extraction with temporal sequence learning. Both models demonstrate superior performance in detecting minority attack classes compared to traditional approaches. This study provides insights into architectural trade-offs between self-attention mechanisms and recurrent-convolutional hybrids, offering practical guidance for implementing robust intrusion detection systems.