MAnTra: A Transformer-Based Approach for Malware Anomaly Detection in Network Traffic Classification - Rizal, Randi; Darmawan, Muhamad Aditya; Selamat, Siti Rahayu; Rahmatulloh, Alam; Haerani, Erna; Tarempa, Genta Nazwar (Informatika, Universitas Jenderal Soedirman, 2025)
Cybersecurity is a critical priority in the ever-evolving digital era, particularly with the emergence of increasingly sophisticated and difficult to detect malware. Traditional detection techniques, such as static and dynamic analysis, are often limited in their ability to recognize novel and concealed malware that poses a threat to security systems. Consequently, this study investigates the potential of Transformer models for network traffic classification to detect anomalies associated with malware activity. The proposed approach emphasizes retrospective analysis, wherein the model is evaluated across various platforms and datasets encompassing different virus variants. By incorporating diverse types of malwares into the training data, the model is better equipped to identify a range of attack patterns. The Transformer model employed in this study was trained over 30 epochs. The evaluation results demonstrated excellent performance, achieving a training accuracy of 99.16% and a test accuracy of 99.32%. The very low average loss value of 0.01 indicates that the model effectively reduces classification errors. These findings underscore the potential of Transformer models as an efficient method for malware detection, offering greater accuracy and speed compared to traditional approaches. The results further reveal that the Transformer exhibits strong capabilities in handling sequential data, which is highly relevant to the dynamic nature of network traffic. For future research, it is recommended to explore the scalability of this method in larger network environments and assess its effectiveness in real-time detection scenarios. Expanding its application could establish the Transformer model as a more reliable and efficient solution for identifying evolving malware threats, thereby enhancing overall network security. This approach presents a robust framework for protecting systems and data against increasingly complex cyber threats.