Retrieval‐Based Deep Hybrid Models for Robust Network Intrusion Detection

A retrieval‐based deep hybrid model couples a learned encoder with a non‐parametric k‐nearest‐neighbors module that, at inference time, retrieves training records and conditions its predictions on the local neighborhood. Despite strong results on tabular benchmarks, such hybrids and several recent deep tabular architectures have not been systematically evaluated for network Intrusion Detection System (IDS) deployment. We benchmark deep hybrids (TabR, ModernNCA, and TabM), transformer‐based tabular variants (FT‐Transformer, ExcelFormer, and TabNet), MLP with periodic embeddings, image model adaptations, and GBDT baselines (XGBoost and CatBoost) on four public NIDS datasets (UNSW‐NB15, ToN‐IoT, Edge‐IIoTset, and UNR‐IDD) using a consistent training and evaluation pipeline. Retrieval‐augmented deep hybrids (TabR and ModernNCA) emerge as the most effective category of models in our study. TabR attains the highest micro and macro‐accuracy on all four datasets. These improvements come with stronger recall for minority attack classes on imbalanced datasets, as evidenced by smaller gaps between the micro and macro‐accuracies. We introduce RobustTabR, a post hoc TabR‐coupled density‐based credibility scoring method that augments each TabR prediction with a calibrated credibility score. RobustTabR constructs a similarity vector from the ordered distances to TabR's retrieved neighbors, converts this vector into a density signature and evaluates whether that signature resembles density signatures observed for in‐distribution training samples. We evaluate RobustTabR on (i) a controlled near‐to‐far OOD spectrum using synthesized datasets and (ii) cross‐dataset transfer on the NetFlow‐v2 suite. Across these OOD settings, RobustTabR provides a calibrated credibility signal that remains competitive with strong density‐based and post hoc OOD detectors while leaving TabR's trained classifier unchanged. RobustTabR's credibility score enables human‐in‐the‐loop triage, with automated high credibility decisions and low credibility events routed for analyst review. Overall, retrieval‐based deep hybrids, benchmarked against a GBDT baseline, offer a practical path to an accurate and drift‐robust IDS.