Papers › A Robust PPO-optimized Tabular Transformer Framework for Intrusion Detection in...

A Robust PPO-optimized Tabular Transformer Framework for Intrusion Detection in Industrial IoT Systems

23 May 2025arXiv:2505.18234archive 2025-07-28

Yuanya She

In this paper, we propose a robust and reinforcement-learning-enhanced network intrusion detection system (NIDS) designed for class-imbalanced and few-shot attack scenarios in Industrial Internet of Things (IIoT) environments. Our model integrates a TabTransformer for effective tabular feature representation with Proximal Policy Optimization (PPO) to optimize classification decisions via policy learning. Evaluated on the TON\textunderscore IoT benchmark, our method achieves a macro F1-score of 97.73\% and accuracy of 98.85\%. Remarkably, even on extremely rare classes like man-in-the-middle (MITM), our model achieves an F1-score of 88.79\%, showcasing strong robustness and few-shot detection capabilities. Extensive ablation experiments confirm the complementary roles of TabTransformer and PPO in mitigating class imbalance and improving generalization. These results highlight the potential of combining transformer-based tabular learning with reinforcement learning for real-world NIDS applications.

Paper PDF Code

Code

RussellTNY/PPO-optimized-Tab-Transformer-for-NIDS-on-TON_IoT official report

Repository list and official/mentioned flags are the archive's, frozen 2025-07-28. Reachability, where shown, is from one Syntology probe window (2026-09-16 to 2026-09-18); repositories not probed show nothing. GitHub stars are not tracked.

Code Syntology ran Syntology

Not run by Syntology. Nothing on this page verifies that the listed code works.

Tasks

Intrusion Detection Network Intrusion Detection Reinforcement Learning reinforcement-learning

Results from the paper archive 2025-07-28

Task	Dataset	Model	Metric	Value	Rank at snapshot	Leaderboard	Report
Network Intrusion Detection	ToN_IoT	PPO optimized TabTransformer	Average Class Accuracy	98.85%	#1 of 1	Archive leaderboard	report

Ranks are positions in the archive's leaderboards as they stood at the 2025-07-28 snapshot. Results published since then are not among these rows, so a rank here is not a current standing.

Methods

Attention Dense Connections Entropy Regularization Layer Normalization Linear Layer Multi-Head Attention PPO Position-Wise Feed-Forward Layer Residual Connection Softmax TabTransformer

Report a problem or propose a change · a person checks every report against the paper or source before anything changes; decisions are listed on /corrections