Toward Unknown/Known Cyberattack Detection with a Causal Transformer

The existing detection methods can either only classify known types of cyberattacks or only distinguish network anomalies to identify whether unknown cyberattacks are present, they are unable to distinguish both known and unknown cyberattack types. To solve these problems, a causal transformer-based cyberattack detection method is proposed. This method aims to eliminate false associations caused by noise features through causal attention to obtain an intelligently interpretable detection method that can classify known attacks and unknown attack types. Validation is performed on two broad and representative datasets. The results show that the proposed causal transformer detection method can not only correctly classify known attacks but also achieve a 100% success rate in identifying cyberattacks on some datasets. Additionally, more than 99% of unknown attack types can be effectively identified and classified, providing timely and effective guidance for cybersecurity defense.