用强化学习优化表格变压器，提升工业物联网罕见攻击检测能力
A Robust PPO-optimized Tabular Transformer Framework for Intrusion Detection in Industrial IoT Systems
- 结合表格变压器与近端策略优化，通过策略学习改进分类决策
- 在TON_IoT数据集上实现97.73%宏F1分数，罕见攻击类仍达88.79% F1
- 适合处理类别不平衡和少样本场景的工业物联网入侵检测任务
本文提出一种鲁棒且基于强化学习的网络入侵检测系统（NIDS），适用于工业互联网（IIoT）环境中类别不平衡和少样本攻击场景。模型融合表格变压器（TabTransformer）进行有效表格特征表示，并采用近端策略优化（PPO）通过策略学习优化分类决策。在TON_IoT基准数据集上，该方法实现97.73%的宏F1分数和98.85%的准确率。尤其在极罕见的中间人攻击（MITM）类别中，仍达到88.79%的F1分数，展现出强鲁棒性和少样本检测能力。大量消融实验验证了TabTransformer与PPO在缓解类别不平衡和提升泛化能力上的互补作用。结果表明，将基于变压器的表格学习与强化学习结合，具有在真实NIDS应用中的潜力。
原文摘要 · Abstract (English)
In this paper, we propose a robust and reinforcement-learning-enhanced network intrusion detection system (NIDS) designed for class-imbalanced and few-shot attack scenarios in Industrial Internet of Things (IIoT) environments. Our model integrates a TabTransformer for effective tabular feature representation with Proximal Policy Optimization (PPO) to optimize classification decisions via policy learning. Evaluated on the TON\textunderscore IoT benchmark, our method achieves a macro F1-score of 97.73\% and accuracy of 98.85\%. Remarkably, even on extremely rare classes like man-in-the-middle (MITM), our model achieves an F1-score of 88.79\%, showcasing strong robustness and few-shot detection capabilities. Extensive ablation experiments confirm the complementary roles of TabTransformer and PPO in mitigating class imbalance and improving generalization. These results highlight the potential of combining transformer-based tabular learning with reinforcement learning for real-world NIDS applications.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。