Outperforming Baseline Transformers: A Neuro-Symbolic Attention Framework for Enhanced Darknet Traffic Analysis and Intrusion Detection

Abstract

Deep learning models are widely used for cybersecurity threat detection, yet they remain difficult to interpret and perform poorly on rare attack classes in imbalanced datasets. Rule-based systems offer transparency and incorporate expert knowledge, but they fail to adapt to new or evolving threats. This work introduces a neuro-symbolic attention mechanism that bridges this gap. The proposed architecture augments a transformer model with an embedded symbolic knowledge base that encodes cybersecurity domain expertise. This knowledge is injected into the attention mechanism so that the model can weigh traffic patterns not only by what it learns statistically but also by how those patterns align with expert-defined threat indicators. We tested the approach on two benchmark datasets, the Canadian Institute for Cybersecurity Darknet 2020 dataset for darknet traffic c lassification an d the Canadian Institute for Cybersecurity Intrusion Detection System 2017 dataset for intrusion detection. On the darknet dataset, the neuro-symbolic attention transformer achieved 94.12 percent accuracy, an improvement of 1.37 percentage points over a standard transformer baseline. On the intrusion detection dataset, which is highly imbalanced and includes rare attack behaviors, the model reached 99.26 percent accuracy, improving accuracy by 14.83 percentage points and precision by 27.72 percentage points. These gains are most pronounced for underrepresented attack classes, suggesting that symbolic guidance helps the model avoid collapsing minority classes into the majority label. The method also provides interpretability as the model can cite which symbolic rules were activated for a given alert.

More by Sapura Sattarova

• A Generative AI-Based Technology for Developing Level-Based Instructional Tasks in Grade 9 Informatics EducationInternational Conference on Computer Science and Engineering · 2026
• Dataset of Uzbek Educational Geography Terminology from School and University CorporaZenodo · 2026
• Neuro-Symbolic Attention Transformers for IoT Sensor Analysis: Integrating Symbolic Temporal Knowledge with Deep LearningInternational Siberian workshops and tutorials on electron devices and materials · 2026
• GENERATIVE AI-BASED ADAPTIVE METHODOLOGY FOR INFORMATICS EDUCATION: RELIABILITY AND EDUCATIONAL EFFECTIVENESS ANALYSIS2026