FlowTransformer: A flexible python framework for flow-based network data analysis

Abstract

FlowTransformer is a software framework tailored for building Machine Learning based Network Intrusion Detection Systems (NIDSs) leveraging transformer architectures known for their effectiveness in both NLP and more broadly for handling sequences of data. FlowTransformer is a flexible pipeline composed of a definable dataset definition, efficient preprocessing, and a flexible model construction, supporting different input-encodings, transformer models and classification heads. Furthermore, users can extend the framework by defining their own components. FlowTransformer’s contribution lies in its easy customisation, and ability to leverage transformers to enable enhanced long-term pattern detection, offering cybersecurity researchers and practitioners a valuable tool.