An explainable, resource-efficient transformer-based IDS with adaptive agent routing

Ozer C., ORMAN Z.

CLUSTER COMPUTING-THE JOURNAL OF NETWORKS SOFTWARE TOOLS AND APPLICATIONS, vol.29, no.11, 2026 (SCI-Expanded, Scopus)

Abstract

Intrusion Detection Systems (IDSs) must detect increasingly diverse cyber threats while operating under strict computational and latency constraints. Although Transformer-based models capture long-range dependencies in network traffic effectively, their deployment in real-time security environments remains limited by the quadratic cost of dense self-attention, the scarcity of labeled attack data, and the need for interpretable predictions. This study proposes an explainable and resource-efficient Transformer-based IDS framework that integrates hybrid sparse attention, mixed-precision training, adaptive agent routing, and a multi-stage auto-labeling strategy. The proposed architecture combines Reformer-style locality-sensitive hashing attention, a fixed local attention window, and a small set of global tokens to reduce computational overhead while preserving short- and long-range traffic dependencies. A lightweight adaptive agent routes high-confidence flows to specialized sub-models, whereas uncertain samples are processed through an auto-labeling pipeline that includes self-training, consistency regularization, MixMatch, adversarial training, and a co-training variant. Experimental results on standard intrusion detection benchmarks show that the proposed framework improves detection performance under limited-label conditions while reducing training time, memory usage, and inference latency relative to dense-attention baselines. In addition, SHAP-based explanations provide global, class-wise, and instance-level interpretability, supporting analyst trust and post hoc security auditing. The findings indicate that the proposed framework offers a practical balance among detection accuracy, computational efficiency, and explainability, making it suitable for deployment in resource-constrained and real-time network security environments.