NFRT–IDS: A Unified Neuro-Fuzzy Reinforcement Transformer Architecture for Adaptive and Explainable Intrusion Detection

Abstract

Intrusion Detection Systems (IDS) are critical to ensuring cybersecurity in complex, dynamic, and data-intensive network environments. Traditional IDS, whether signature-based or classical machine learning (ML)-based, struggle to adapt to evolving attack patterns and to provide explainable decisions in real time. This paper presents a comprehensive evolutionary framework leading to a new unified model: the Neuro-Fuzzy Reinforcement Transformer Intrusion Detection System (NFRT-IDS). Three intermediate hybrid algorithms, a Transformer-CNN (Convolutional Neural Network) IDS, a Fuzzy–Ensemble IDS, and a Deep Q-Learning based Artificial Neural Network (DQL–ANN) IDS, are first proposed, rigorously optimized through cross-validation, and extensively evaluated on benchmark datasets (CICIDS2017, UNSW-NB15, and BoT-IoT). These models respectively address deep feature extraction, interpretability, and adaptive decision optimization challenges in IDS, while providing complementary architectural and learning advantages. Their integration inspired the unified NFRT-IDS framework, which combines global attention-based feature learning, fuzzy inference for uncertainty modeling and rule-based explainability, and reinforcement learning (DQL agent) for dynamic parameter adaptation and performance-driven optimization. Experimental results demonstrate that NFRT-IDS achieves superior performance, reaching 99.98% accuracy and F1-score on CICIDS2017, with a 0.31% False Alarm Rate (FAR) and 0.999 AUC, outperforming state-of-the-art hybrid models. Beyond single-dataset evaluation, NFRT-IDS exhibits strong cross-dataset generalization, maintaining consistent accuracy and F1-scores when trained on CICIDS2017 and evaluated on heterogeneous datasets such as UNSW-NB15 and BoT-IoT. Furthermore, the framework ensures scalability, robustness, and interpretability, enabling efficient real-time intrusion detection in modern IoT and cloud environments.