Adaptive active learning and metaheuristic-optimized transformer framework for robust intrusion detection in software-defined networks

Existing intrusion detection systems largely rely on static supervised learning models that require extensive labeled data and periodic retraining. Such approaches struggle to adapt to evolving attack patterns in dynamic software-defined networks. To address these limitations, this study proposes an adaptive intrusion detection framework that integrates uncertainty-driven active learning, metaheuristic-based feature selection, Transformer-based attack classification, and adaptive hyperparameter optimization within a unified software-defined networking architecture. Unlike conventional adaptive intrusion detection systems that rely on static feature representations or fixed learning strategies, the proposed framework continuously refines both the training data and model configuration to improve robustness against evolving cyberattacks. The proposed framework iteratively identifies informative samples for annotation, optimizes feature subsets using adaptive search, and continuously updates the classifier to maintain high detection performance under changing traffic distributions. The proposed system was evaluated using the ToN-IoT dataset and additional real-world traffic traces. Experimental evaluation on benchmark and real-world network traffic datasets demonstrated a detection accuracy of up to 97.92% and an F1-score of 97.10%. Although the optimization stage increases offline training time, the optimized model maintains efficient inference during deployment, making it suitable for practical software-defined network environments. Performance was evaluated over five independent runs using different random initialization seeds. Although the optimization and active-learning stages increase offline training time, the optimized model maintains efficient inference during deployment. Performance was evaluated over five independent runs using different random initialization seeds. The results demonstrate that the complementary use of adaptive sample acquisition, feature selection, and hyperparameter optimization provides an effective intrusion-detection framework for software-defined network environments.