A Wavelet-Based Derivative-Aware Transformer for Network Intrusion Detection

Modern network attacks exhibit both abrupt anomalies and gradual temporal deviations, posing significant challenges to traditional intrusion detection systems. This paper introduces WDT-NID, a novel wavelet-based derivative-aware transformer that integrates wavelet decomposition for multi-scale feature extraction with the calculus of finite differences to capture critical rate-of-change dynamics in network traffic. These enhanced temporal-frequency representations are processed by a derivative-aware transformer architecture designed to model both amplitude variations and derivative-sensitive dependencies. The framework uses this proposed WDT-NID optimizes self-supervised contrastive and reconstruction objectives to learn a compact manifold of normal network behavior, where deviations are treated as potential intrusions. Experimental results on the CIC-IDS2017 benchmark demonstrate that WDT-NID achieves superior detection performance compared to existing methods, effectively identifying both high-intensity burst attacks and low-rate infiltration attempts while maintaining a significantly reduced false positive rate.