Abstract
In fog computing, efficient and accurate network intrusion detection (NID) is critical due to the unique security challenges of distributed architectures. This research proposes a novel Transformer-based framework for NID, leveraging advanced Transformer architectures to improve feature extraction and intrusion classification. The proposed model is intended to detect different types of attack related to the attack categories including Denial-of-Service, Probe, Remote-to-Local, and User-to-Root. The proposed model utilized both the NSL-KDD and IoT-20 datasets. The results of the conducted experiments reveal that the model achieves 100% accuracy, precision, recall, and F1-score on NSL-KDD dataset while it demonstrates 99.60% accuracy in binary classification and 95.37% in multiclass classification on IoT-20 dataset. To ensure the robustness and overfitting mitigation, the model utilized cross-validation, regularization, and adversarial testing. In addition, the inclusion of the IoT-20 dataset ensures relevance to contemporary network security challenges, while attention mechanisms and explainable AI techniques enhance interpretability and practical applicability. This study highlights the transformative potential of Transformer-based models for NID in fog computing, offering a robust, scalable, and interpretable solution for securing distributed architectures.
Data availability
The datasets analyzed in this study are publicly available. The NSL-KDD dataset can be accessed via the University of New Brunswick’s Canadian Institute for Cybersecurity repository at [https://www.unb.ca/cic/datasets/nsl.html](https:/www.unb.ca/cic/datasets/nsl.html) . The IoT-20 traffic data is available through the Stratosphere Laboratory (IoT-23 dataset project) at [https://www.stratosphereips.org/datasets-iot23](https:/www.stratosphereips.org/datasets-iot23) .
References
Ometov, A., Molua, O. L., Komarov, M. & Nurmi, J. A survey of security in cloud, edge. Fog Comput. Sens. 22 (1), 1–27. https://doi.org/10.3390/s22030927 (2022).
Abdulkareem, K. H. et al. A review of fog computing and machine learning: Concepts, applications, challenges, and open issues. IEEE Access. 7, 153123–153140. https://doi.org/10.1109/ACCESS.2019.2947542 (2019).
Pallas, F., Raschke, P. & Bermbach, D. Fog computing as privacy enabler. IEEE Internet Comput. 24 (1), 15–21. https://doi.org/10.1109/MIC.2020.2979161 (2020).
Zhao, G., Wang, Y. & Wang, J. Lightweight intrusion detection model of the internet of things with hybrid cloud-fog computing. Secur. Commun. Netw. 2023 https://doi.org/10.1155/2023/7107663 (2023).
Onah, J. O., Abdulhamid, S. M., Abdullahi, M., Hassan, I. H. & Al-Ghusham, A. Genetic algorithm-based feature selection and Naïve Bayes for anomaly detection in fog computing environment. Mach. Learn. Appl. 6, 100156. https://doi.org/10.1016/j.mlwa.2021.100156 (2021).
Khater, B. S. et al. Classifier performance evaluation for lightweight Ids using fog computing. Iot Secur. Electron. 10 (1). https://doi.org/10.3390/electronics10141633 (2021).
Moh, M. (ed, R.) Machine learning techniques for security of internet of things (IoT) and fog computing systems. Proc. – 2018 Int. Conf. High. Perform. Comput. Simul. (HPCS 2018) 709–715 https://doi.org/10.1109/HPCS.2018.00116 (2018).
Alsarhan, A., Alauthman, M., Alshdaifat, E., Al-Ghuwairi, A. R. & Al-Dubai, A. Machine learning-driven optimization for SVM-based intrusion detection system in vehicular ad hoc networks. J. Ambient Intell. Humaniz. Comput. 14 (6), 6113–6122. https://doi.org/10.1007/s12652-021-02963-x (2023).
Gahi, Y. & El Alaoui, I. Studies in Computational Intelligence, 919. (Springer Int. Publishing. 29–49. https://doi.org/10.1007/978-3-030-57024-8_2 (2021). Machine learning and deep learning models for big data issues.
Sharma, P., Jain, S., Gupta, S. & Chamola, V. Role of machine learning and deep learning in Securing 5G-driven industrial IoT applications. Ad Hoc Netw. 123, 102685. https://doi.org/10.1016/j.adhoc.2021.102685 (2021).
Ma, M., Han, L. & Zhou, C. Research and application of transformer-based anomaly detection model: A literature review. ArXiv https://doi.org/10.48550/ArXiv.2402.08975 (2024).
Ho, C. M. K., Yow, K. C., Zhu, Z. & Aravamuthan, S. Network intrusion detection via flow-to-image conversion and vision transformer classification. IEEE Access. 10, 97780–97793. https://doi.org/10.1109/ACCESS.2022.3200034 (2022).
Lazarevic, A., Ertoz, L., Kumar, V., Ozgur, A. & Srivastava, J. A comparative study of anomaly detection schemes in network intrusion detection. 25–36. https://doi.org/10.1137/1.9781611972733.3 (2003).
Catania, C. A. & Garino, C. G. Automatic network intrusion detection: current techniques and open issues. Comput. Electr. Eng. 38 (4), 1062–1072. https://doi.org/10.1016/j.compeleceng.2012.05.013 (2012).
Dokas, P. et al. Data mining for network intrusion detection. Natl. Sci. Foundation Workshop Next Generation Data Min. 38, 21–30. https://doi.org/10.1111/j.1540-5915.2001.tb00975.x (2002).
Zhong, S., Khoshgoftaar, T. M. & Seliya, N. Clustering-based network intrusion detection. Int. J. Reliab. Qual. Saf. Eng. 14 (2), 169–187. https://doi.org/10.1109/DSC54232.2022.9888886 (2007).
Srivastava, R. Survey of current network intrusion detection techniques. http://www.cse.wustl.edu/~jain/cse571-07/ftp/ids/ (2013).
García-Teodoro, P., Díaz-Verdejo, J., Maciá-Fernández, G. & Vázquez, E. Anomaly-based network intrusion detection: Techniques, systems and challenges. Computers Secur. 28 (1–2), 18–28. https://doi.org/10.1016/j.cose.2008.08.003 (2009).
Liao, H. J., Lin, R., Lin, C. H., Tung, K. Y. & Y. C., & Intrusion detection system: A comprehensive review. J. Netw. Comput. Appl. 36 (1), 16–24. https://doi.org/10.1016/j.jnca.2012.09.004 (2013).
de Souza, C. A., Westphall, C. B. & Machado, R. B. Two-step ensemble approach for intrusion detection and identification in IoT and fog computing environments. Comput. Electr. Eng. 98, 107694. https://doi.org/10.1016/j.compeleceng.2022.107694 (2022).
de Souza, C. A., Westphall, C. B., Machado, R. B., Sobral, J. B. M. & Vieira, G. dos S. Hybrid approach to intrusion detection in fog-based IoT environments. Comput. Netw. 180, 107417. https://doi.org/10.1016/j.comnet.2020.107417 (2020).
Alzubi, O. A. et al. Optimized machine learning-based intrusion detection system for fog and edge computing environment. Electronics 11(1), 1–16. https://doi.org/10.3390/electronics11193007 (2022).
Saipriya, T. & Anand, M. To secure IoT sensor nodes through fog computing. In Proceedings of the 2nd International Conference on Electronics and Sustainable Communication Systems (ICESC 2021), 99, 836–844. https://doi.org/10.1109/ICESC51422.2021.9532693 (2021).
Diro, A. A. & Chilamkurti, N. Distributed attack detection scheme using deep learning approach for internet of things. Future Generation Comput. Syst. 82, 761–768. https://doi.org/10.1016/j.future.2017.08.043 (2018).
Bhuvaneswari, B. A. Anomaly detection framework for internet of things traffic using vector convolutional deep learning approach in fog environment. Future Generation Comput. Syst. 113, 255–265. https://doi.org/10.1016/j.future.2020.07.020 (2020).
Almiani, M., AbuGhazleh, A., Al-Rahayfeh, A., Atiewi, S. & Razaque, A. Deep recurrent neural network for IoT intrusion detection system. Simul. Model. Pract. Theory. 101, 102031. https://doi.org/10.1016/j.simpat.2019.102031 (2020).
Verma, K. et al. Deep-IFS: intrusion detection approach for industrial internet of things traffic in fog environment. IEEE Access. 10, 66–82. https://doi.org/10.1109/TII.2020.3025755 (2022).
Prabavathy, S., Sundarakantham, K. & Shalinie, S. M. Design of cognitive fog computing for intrusion detection in internet of things. J. Commun. Netw. 20 (3), 291–298. https://doi.org/10.1109/JCN.2018.000041 (2018).
Shone, N., Ngoc, T. N., Phai, V. D. & Shi, Q. A Deep Learning Approach to Network Intrusion Detection. IEEE Trans. Emerg. Top. Comput. Intell. 2(1), 41–50. https://doi.org/10.1109/TETCI.2017.2772792 (2018).
Yin, C., Zhu, Y., Fei, J. & He, X. A deep learning approach for intrusion detection using recurrent neural networks. EEE Access. 5, 21954–21961. https://doi.org/10.1109/ACCESS.2017.2762418 (2017).
Wang, W. et al. HAST-IDS: learning hierarchical spatial-temporal features using deep neural networks to improve intrusion detection. IEEE Access. 6, 1792–1806. https://doi.org/10.1109/ACCESS.2017.2780250 (2017).
Zhang, K., Fang, M., Yin, L., Chen, L. & Liu, Z. A deep learning approach for network intrusion detection based on NSL-KDD dataset. Proc. 2019 Int. Conf. Adv. Softw. Eng. Inform. Technol. (ICESIT). https://doi.org/10.1109/ICASID.2019.8925239 (2019).
Hwang, R. H., Peng, M. C., Nguyen, V. L. & Chang, Y. L. An LSTM-based deep learning approach for classifying malicious traffic at the packet level. Appl. Sci. 9 (1). https://doi.org/10.3390/app9163414 (2019).
Kao, M. T., Sung, D. Y., Kao, S. J., Chang, F. M. & Electronics A novel two-stage deep learning structure for network flow anomaly detection. 11(1). https://doi.org/10.3390/electronics11101531 (2022).
Hwang, R. H., Peng, M. C., Huang, C. W., Lin, P. C. & Nguyen, V. L. An unsupervised deep learning model for early network traffic anomaly detection. IEEE Access. 8, 30387–30399. https://doi.org/10.1109/ACCESS.2020.2973023 (2020).
Cao, B., Li, C., Song, Y., Qin, Y. & Chen, C. Network intrusion detection model based on CNN and GRU. Appl. Sci. 12 (1). https://doi.org/10.3390/app12094184 (2022).
Elsayed, S., Mohamed, K. & Madkour, M. A. A comparative study of using deep learning algorithms in network intrusion detection. IEEE Access. 12, 58851–58870. https://doi.org/10.1109/ACCESS.2024.3389096 (2024).
AlOmar, B., Trabelsi, Z. & Saidi, F. Attention-based deep learning modelling for intrusion detection. In European Conference on Information Warfare SecurityECCWS 22–32. https://doi.org/10.1016/j.procs.2024.09.307 (2023).
Zegarra Rodríguez, D., Daniel Okey, O., Maidin, S. S., Umoren Udo, E. & Kleinschmidt, J. H. Attentive transformer deep learning algorithm for intrusion detection on IoT systems using automatic xplainable feature selection. PLoS One. 18 (1), 1–25. https://doi.org/10.1371/journal.pone.0286652 (2023).
Gan, G. & Kong, W. Research on network intrusion detection based on transformer. Front. Comput. Intell. Syst. 3(1), 22–26. https://doi.org/10.3390/s25092725 (2023).
Najari, N., Berlemont, S., Lefebvre, G., Duffner, S. & Garcia, C. RESIST: Robust transformer for unsupervised time series anomaly detection. In Lecture Notes in Computer Science (including Subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics), 13812 LNAI, 66–82. https://doi.org/10.1007/978-3-031-24378-3_5 (2023).
Hanafi, H. et al. IDSX-Attention: intrusion detection system (IDS) based hybrid MADE-SDAE and LSTM-Attention mechanism. Int. J. Adv. Intell. Inf. 9 (2), 121–135. https://doi.org/10.26555/ijain.v9i1.942 (2023).
Radhi Hadi, M. & Saher Mohammed, A. A novel approach to network intrusion detection system using deep learning for SDN: futuristic approach. Comput. Sci. Inform. Technol. (CS IT). 69–82 https://doi.org/10.5121/csit.2022.121106 (2022).
Maz, Y. A. et al. Transfer Learning-Based approach with an ensemble classifier for detecting keylogging attack on the internet of things. Computers Mater. Continua. 0 (0), 1–10. https://doi.org/10.32604/cmc.2025.068257 (2025).
Sanjalawe, Y. et al. Smart load balancing in cloud computing: integrating feature selection with advanced deep learning models. PLOS One. 20 (9), 1–15. https://doi.org/10.1371/journal.pone.0329765 (2025).
Abualhaj, M. M. et al. Enhanced network communication security through hybrid Dragonfly-Bat feature selection for intrusion detection. J. Commun. 20 (5), 607–618. https://doi.org/10.12720/jcm.20.5.607-618 (2025).
Alsaaidah, A. et al. ARP spoofing attack detection model in IoT network using machine learning: Complexity vs. accuracy. J. Appl. Data Sci. 5(4), 1850–1860. https://doi.org/10.47738/jads.v5i4.374 (2024).
Almomani, O. et al. Enhance URL defacement attack detection using particle swarm optimization and machine learning. J. Comput. Cogn. Eng. 4 (3), 296–308. https://doi.org/10.47852/bonviewJCCE52024668 (2025).
Almaiah, M. A. et al. Classification of cybersecurity Threats, vulnerabilities and countermeasures in database Systems. Computers. Mater. Continua. 81 (2), 3189–3220. https://doi.org/10.32604/cmc.2024.057673 (2024).
Ullah, I. et al. A scheme for generating a dataset for anomalous activity detection in IoT networks. Lect. Notes Comput. Sci. 12109 (2), 508–520. https://doi.org/10.1007/978-3-030-47358-7_52 (2020).
Ahanger, A. S. et al. Intrusion detection system for IoT environment using ensemble approaches. In 10th International Conference on Computing for Sustainable Global Development (INDIACom), 1(1), 1–6. https://doi.org/10.1109/INDIACom56084.2023.10112382 (2023).
Shambour, Q. et al. Quantum-Inspired hybrid metaheuristic feature selection with SHAP for optimized and explainable spam detection. Symmetry https://doi.org/10.3390/sym17101716 (2025).
Cakiroglu, C. et al. Data-driven interpretable ensemble learning methods for the prediction of wind turbine power incorporating SHAP analysis. Expert Syst. Appl., https://doi.org/10.1016/j.eswa.2023.121464 (2024).
Shambour, Q. Y. et al. Leveraging feature selection and explainable ai for effective autism screening. In Proceeding-12th International Conference on Information Technology: Innovation Technologies, ICIT 2025. https://doi.org/10.1109/ICIT64950.2025.11049263 (2025).
Hanandeh, E. et al. Optimizing deep learning scalability: Harnessing distributed systems and cloud computing for Next-Generation AI. Z. Deep Learn. AI. 18 https://doi.org/10.1201/9781003516385-18 (2025).
Mahfouz, K. H. et al. Mitigating the task scheduling problem in fog computing environments using marine predators optimization algorithm. Cluster Comput. https://doi.org/10.1007/s10586-025-05632-2 (2025).
Acknowledgements
The authors did not receive any specific grant from funding agencies in the public, commercial, or not-for-profit sectors for this research.
Author information
Authors and Affiliations
Contributions
Khalil M. Abdelnaby: Contributed to the conceptualization of the study, model design, data pre-processing, implementation, experimentation, and preparation of the original manuscript draft. Ahmed Y. Khedr and Aly M. Elsemary: Contributed to methodology refinement, results analysis, validation, and critical review and editing of the manuscript. All authors have read and approved the final version of the manuscript.
Corresponding author
Ethics declarations
Competing interests
The authors declare no competing interests.
Additional information
Publisher’s note
Springer Nature remains neutral with regard to jurisdictional claims in published maps and institutional affiliations.
Rights and permissions
Open Access This article is licensed under a Creative Commons Attribution 4.0 International License, which permits use, sharing, adaptation, distribution and reproduction in any medium or format, as long as you give appropriate credit to the original author(s) and the source, provide a link to the Creative Commons licence, and indicate if changes were made. The images or other third party material in this article are included in the article’s Creative Commons licence, unless indicated otherwise in a credit line to the material. If material is not included in the article’s Creative Commons licence and your intended use is not permitted by statutory regulation or exceeds the permitted use, you will need to obtain permission directly from the copyright holder. To view a copy of this licence, visit http://creativecommons.org/licenses/by/4.0/.
About this article
Cite this article
Abdelnaby, K.M., Khedr, A.Y. & Elsemary, A.M. Novel transformer-based model for NID in fog computing environment. Sci Rep (2026). https://doi.org/10.1038/s41598-026-35879-7
Received:
Accepted:
Published:
DOI: https://doi.org/10.1038/s41598-026-35879-7
