Genetic-Algorithm Feature Selection for Evaluating Self-Supervised Transformers and Gradient-Boosted Trees in Flow-Based Intrusion Detection

Abstract

This study examines whether a self-supervised Transformer improves flow-based network intrusion detection when every model receives the same features, selected by a genetic algorithm (GA) whose logistic-regression surrogate is independent of the evaluated models. Transformer architectures and self-supervised pretraining are increasingly proposed for intrusion detection, but their advantage over strong classical baselines on tabular flow data is rarely tested under controlled conditions. We introduce a model-agnostic genetic-algorithm feature-selection stage and use it to compare a self-supervised tabular Transformer (SST-IDS) with Random Forest, XGBoost, CNN, LSTM, and TabTransformer on CIC-IDS-2017 and UNSW-NB15. The protocol uses identical seed-specific feature sets and stratified splits for every paired model, five random seeds on both datasets, full 20-epoch pretraining and 20-epoch fine-tuning schedules with early stopping, and paired significance tests. XGBoost achieved 0.9456±0.0067 accuracy and 0.9856±0.0078 AUC on UNSW-NB15, compared with 0.9257±0.0040 and 0.9781±0.0076 for SST-IDS. On the disclosed 20,000-flow CIC sample, XGBoost achieved 0.9963±0.0007 accuracy and 0.9998±0.0001 AUC. Full training increased SST-IDS mean UNSW-NB15 AUC from 0.9705 to 0.9781 relative to the reduced schedule, but did not reverse the comparative result. Zero-shot transfer was unstable: SST-IDS reached mean AUC 0.6126±0.1960, while Random Forest and XGBoost remained below 0.5 on average. SHAP explanations and identically measured deployment costs complete the analysis.