AI-Driven Intrusion Detection

A hybrid TabNet + Transformer deep-learning architecture for real-time network intrusion detection across critical infrastructure.

TabNet Transformers CIC-IDS 2017 Docker / Kubernetes
Back to Portfolio
AI-Driven Intrusion Detection for Critical Systems

Overview

A hybrid deep-learning intrusion detection architecture combining TabNet and Transformers, trained and evaluated on the CIC-IDS 2017 cybersecurity dataset. Attention-based feature learning improves classification of malicious network-traffic patterns, with the detection model deployed via Docker and Kubernetes for scalable, real-time monitoring across critical infrastructure nodes.

Purpose — Why This Project Exists

Traditional signature-based intrusion detection only catches attacks it has already seen — it misses novel or evolving network-traffic patterns that critical infrastructure is increasingly targeted with. This project exists to combine TabNet's strength on structured tabular traffic features with Transformer attention over sequence patterns, so the system generalizes better to attack behavior it hasn't explicitly been trained on.

Animated Pipeline

1
Traffic Capture
Network traffic features extracted per flow.
2
Feature Extraction
CIC-IDS 2017-style structured feature set built.
3
TabNet Branch
Learns from structured tabular traffic features.
4
Transformer Attention
Attention layers model traffic-pattern relationships.
5
Fused Classification
Combined signal classifies malicious vs. benign traffic.
6
K8s-Deployed Alerting
Scalable, real-time monitoring across infrastructure nodes.

Key Features

Hybrid Architecture — combines TabNet and Transformers for structured + sequential learning.
CIC-IDS 2017 Dataset — trained and evaluated on a standard network-intrusion benchmark.
Attention-Based Learning — improves classification of malicious traffic patterns.
Docker + Kubernetes Deployment — scalable, real-time monitoring across infrastructure nodes.

Benefits

Catches Novel Attacks

Attention-based learning generalizes beyond known attack signatures.

Real-Time Monitoring

Deployed for live, continuous traffic classification.

Scales with Kubernetes

Deployment architecture built to scale across infrastructure nodes.

Technology Stack

Python TabNet Transformers Docker Kubernetes
Back to Portfolio