  Many cybersecurity problems that require real-time decision-making based on
temporal observations can be abstracted as a sequence modeling problem, e.g.,
network intrusion detection from a sequence of arriving packets. Existing
approaches like reinforcement learning may not be suitable for such
cybersecurity decision problems, since the Markovian property may not
necessarily hold and the underlying network states are often not observable. In
this paper, we cast the problem of real-time network intrusion detection as
casual sequence modeling and draw upon the power of the transformer
architecture for real-time decision-making. By conditioning a causal decision
transformer on past trajectories, consisting of the rewards, network packets,
and detection decisions, our proposed framework will generate future detection
decisions to achieve the desired return. It enables decision transformers to be
applied to real-time network intrusion detection, as well as a novel tradeoff
between the accuracy and timeliness of detection. The proposed solution is
evaluated on public network intrusion detection datasets and outperforms
several baseline algorithms using reinforcement learning and sequence modeling,
in terms of detection accuracy and timeliness.
