AURORA-IDS: Agent-Guided Routing-Deformable Attention for Robust Semi-Supervised Intrusion Detection on Tabular Traffic Data

Real-world intrusion detection on network traffic is hindered by high-dimensional tabular features, severe class imbalance, scarce labels, and label noise, which bias models toward dominant benign patterns and suppress minority-attack recall under distribution shift. We propose AURORA-IDS, anagent-guidedrouting-attention framework for weakly labeled and semi-supervised tabular intrusion detection. A leak-free preprocessing pipeline, fit exclusively on the training split and reused unchanged on validation/test data, performs inf/NaN sanitization, percentile clipping, median/IQR scaling, and bounded postscaling to stabilize optimization. The model adopts a single-stream Transformer that mixes feature tokens with global memory tokens and introduces Routing-Deformable Omni-Attention: a Top-Krouter selects informative local interactions while global tokens preserve long-range context; entropy and concentration regularizers discourage attention collapse. Training follows two stages: 1) self-supervised pretraining with masked feature modeling (MFM), contrastive learning, and EMA-teacher distillation and 2) semi-supervised finetuning with class-weighted supervision and a lightweight classwise pseudo-label controller (referred to as theagent) that adaptively governs pseudo-label thresholds and per-class budgets. Unlike prototype-only regularization, pure consistency regularization, or posthoc calibration alone, AURORA-IDS jointly couples sparse–global token interaction, classwise pseudo-label control, and prototype anchoring in one end-to-end pipeline. An unsupervised-loss ramp-up and a class-balanced threshold bias mitigate early domination by majority classes. A prototype memory further stabilizes embeddings and provides interpretable, drift-aware signals via prototype distances and embedding exports. Experiments on CICIDS2017 demonstrate consistent gains in Macro-$F1$and minority-class recall under weak labeling and noisy supervision.