Transformer-Autoencoder-Based Unsupervised Temporal Anomaly Detection for Network Traffic with Dual Prediction and Reconstruction

With the rapid growth of large-scale networks, traditional rule-based and supervised anomaly detection methods struggle with heavy reliance on labeled data, slow response to rapidly changing patterns, and difficulty in capturing complex temporal anomalies. At the same time, real-world traffic exhibits strong class imbalance, where normal samples overwhelmingly dominate, causing many existing models to miss subtle but critical abnormal behaviors. To address these challenges, this paper proposes an unsupervised temporal anomaly detection framework for network traffic based on a Transformer-autoencoder bidirectional prediction and reconstruction model. The framework combines the advantages of autoencoders and regression models, using multi-head self-attention and positional encoding to capture long-range temporal dependencies in traffic sequences. A masked decoding mechanism is further employed to prevent information leakage from future time steps. The model jointly generates forward and backward predictions as well as reconstructed sequences, and designs multiple anomaly scoring strategies that integrate prediction and reconstruction errors to enhance the sensitivity to point, contextual, and collective anomalies under highly imbalanced data. Experiments on three public benchmark datasets demonstrate that the proposed method significantly improves detection performance, achieving up to an F1 score of 0.960 and a precision of 0.949, with recall approaching 1.0, while reducing false alarms, thereby showing strong applicability to practical network security scenarios.