TrailGate: A Staged Intrusion Detection Framework

• TrailGate is a network intrusion detection framework that uses a two-stage pipeline integrating Random Forest for screening and BiGRU-Transformer for refined classification.
• It employs a comprehensive methodology including ADASYN for data augmentation, IG, PCC, CL, and IFS for robust feature selection, addressing class imbalance and label noise.
• Empirical evaluations on NSL-KDD and UNSW-NB15 demonstrate competitive accuracy and improved detection performance over prior methods.

Searching arXiv for the specified paper to ground the article in the cited source. TrailGate is a network intrusion detection framework introduced in "A transformer-BiGRU-based framework with data augmentation and confident learning for network intrusion detection" (Zhang et al., 5 Sep 2025). It is defined by a two-stage pipeline that combines machine-learning and deep-learning components: a Random Forest binary classifier first separates normal from abnormal traffic, and a BiGRU plus Transformer Encoder model then performs refined binary or multi-class classification over abnormal traffic. The framework is designed for settings in which network intrusion datasets exhibit complex patterns, data scarcity, class imbalance, and label noise, and it integrates preprocessing, data augmentation, feature selection, and confident learning into a single workflow (Zhang et al., 5 Sep 2025).

1. Architectural definition

TrailGate is organized as a two-stage pipeline. In Stage 1, input $X$ is represented as 41-dimensional data after encoding and Min–Max scaling and is processed by a Random Forest binary classifier for normal-versus-abnormal discrimination. This stage uses a lightweight feature subset to filter out the bulk of normal traffic. In Stage 2, the abnormal traffic identified by Stage 1 is passed to a BiGRU + Transformer Encoder model for refined binary or multi-class classification, including DoS, Probe, U2R, and R2L (Zhang et al., 5 Sep 2025).

The data flow is explicitly specified as follows: raw records are transformed by categorical encoding and Min–Max scaling; the processed data are then subjected to ADASYN oversampling, a Confident-Learning filter, an Information-Gain and PCC filter, and Incremental Feature Selection; the selected features feed the Random Forest binary stage; normal traffic is filtered out; and the remaining abnormal subset is classified by the BiGRU+Transformer stage into final labels (Zhang et al., 5 Sep 2025).

This construction makes TrailGate a cascade rather than a monolithic classifier. A plausible implication is that the first stage functions as a high-throughput screening module, while the second stage concentrates modeling capacity on the comparatively difficult subset of abnormal traffic.

2. Mathematical components

The BiGRU component is used to capture forward and backward temporal dependencies. Its forward and backward recurrences are defined as

$$h^{\rightarrow}_t = GRU(h^{\rightarrow}_{t-1}, x_t), \qquad h^{\leftarrow}_t = GRU(h^{\leftarrow}_{t+1}, x_t),$$

with combined hidden state and output

$$h_t = [h^{\rightarrow}_t; h^{\leftarrow}_t], \qquad y_t = W_y h_t + b_y.$$

For a single-direction GRU cell, the update is given by

$z_t = \sigma(W_z[x_t;h_{t-1}] + b_z),$

$r_t = \sigma(W_r[x_t;h_{t-1}] + b_r),$

$$\hat{h}_t = \tanh(W_h[x_t; r_t \odot h_{t-1}] + b_h),$$

$h_t = (1-z_t)\odot h_{t-1} + z_t \odot \hat{h}_t.$

These equations define the recurrent mechanism used in the second stage (Zhang et al., 5 Sep 2025).

The Transformer Encoder applies multi-head self-attention to the sequence $\{h_t\}$. The attention and multi-head operators are written as

$Attention(Q,K,V)=softmax(QK^\top/\sqrt{d_k})V,$

$MultiHead(Q,K,V)=Concat(head_1,\ldots,head_H)W^O.$

For each head $$h^{\rightarrow}_t = GRU(h^{\rightarrow}_{t-1}, x_t), \qquad h^{\leftarrow}_t = GRU(h^{\leftarrow}_{t+1}, x_t),$$0,

$$h^{\rightarrow}_t = GRU(h^{\rightarrow}_{t-1}, x_t), \qquad h^{\leftarrow}_t = GRU(h^{\leftarrow}_{t+1}, x_t),$$1

followed by Add & Norm and a feed-forward network. Within TrailGate, the BiGRU provides bidirectional sequential modeling, while the Transformer Encoder contributes multi-head self-attention over the resulting latent sequence (Zhang et al., 5 Sep 2025).

The loss specified for training deep models is cross-entropy:

$$h^{\rightarrow}_t = GRU(h^{\rightarrow}_{t-1}, x_t), \qquad h^{\leftarrow}_t = GRU(h^{\leftarrow}_{t+1}, x_t),$$2

The source explicitly states that this is used in both stages when training deep models (Zhang et al., 5 Sep 2025). Since Stage 1 is instantiated as a Random Forest in the pipeline description, this suggests that the loss expression is primarily relevant to the BiGRU+Transformer stage and to the confident-learning probability estimation procedures that depend on predictive outputs.

3. Feature-selection and label-noise handling

TrailGate includes a multi-part feature-selection pipeline consisting of Information Gain (IG), Pearson Correlation Coefficient (PCC), Confident Learning (CL), and Incremental Feature Selection (IFS) (Zhang et al., 5 Sep 2025). The framework description characterizes this combination as a universal feature-selection pipeline.

For Information Gain, the entropy of the label variable is defined as

$$h^{\rightarrow}_t = GRU(h^{\rightarrow}_{t-1}, x_t), \qquad h^{\leftarrow}_t = GRU(h^{\leftarrow}_{t+1}, x_t),$$3

and for a discrete feature $$h^{\rightarrow}_t = GRU(h^{\rightarrow}_{t-1}, x_t), \qquad h^{\leftarrow}_t = GRU(h^{\leftarrow}_{t+1}, x_t),$$4,

$$h^{\rightarrow}_t = GRU(h^{\rightarrow}_{t-1}, x_t), \qquad h^{\leftarrow}_t = GRU(h^{\leftarrow}_{t+1}, x_t),$$5

For continuous features, values are sorted, candidate midpoints $$h^{\rightarrow}_t = GRU(h^{\rightarrow}_{t-1}, x_t), \qquad h^{\leftarrow}_t = GRU(h^{\leftarrow}_{t+1}, x_t),$$6 are considered, the feature is discretized at $$h^{\rightarrow}_t = GRU(h^{\rightarrow}_{t-1}, x_t), \qquad h^{\leftarrow}_t = GRU(h^{\leftarrow}_{t+1}, x_t),$$7, and the maximum $$h^{\rightarrow}_t = GRU(h^{\rightarrow}_{t-1}, x_t), \qquad h^{\leftarrow}_t = GRU(h^{\leftarrow}_{t+1}, x_t),$$8 is selected (Zhang et al., 5 Sep 2025). In TrailGate, IG is used both for feature ranking and as the basis for subsequent IFS.

PCC is used to remove redundant features. The correlation between features $$h^{\rightarrow}_t = GRU(h^{\rightarrow}_{t-1}, x_t), \qquad h^{\leftarrow}_t = GRU(h^{\leftarrow}_{t+1}, x_t),$$9 and $$h_t = [h^{\rightarrow}_t; h^{\leftarrow}_t], \qquad y_t = W_y h_t + b_y.$$0 is

$$h_t = [h^{\rightarrow}_t; h^{\leftarrow}_t], \qquad y_t = W_y h_t + b_y.$$1

Feature pairs with $$h_t = [h^{\rightarrow}_t; h^{\leftarrow}_t], \qquad y_t = W_y h_t + b_y.$$2 are filtered, retaining the one with higher IG; the threshold is $$h_t = [h^{\rightarrow}_t; h^{\leftarrow}_t], \qquad y_t = W_y h_t + b_y.$$3 for binary classification and $$h_t = [h^{\rightarrow}_t; h^{\leftarrow}_t], \qquad y_t = W_y h_t + b_y.$$4 for multi-class classification (Zhang et al., 5 Sep 2025).

Confident Learning is used for noisy-label detection. The procedure is stated in four steps: obtain model-predicted probabilities $$h_t = [h^{\rightarrow}_t; h^{\leftarrow}_t], \qquad y_t = W_y h_t + b_y.$$5 via cross-validation; compute class-wise confidence thresholds

$$h_t = [h^{\rightarrow}_t; h^{\leftarrow}_t], \qquad y_t = W_y h_t + b_y.$$6

build counts

$$h_t = [h^{\rightarrow}_t; h^{\leftarrow}_t], \qquad y_t = W_y h_t + b_y.$$7

normalize them as

$$h_t = [h^{\rightarrow}_t; h^{\leftarrow}_t], \qquad y_t = W_y h_t + b_y.$$8

and treat samples with $$h_t = [h^{\rightarrow}_t; h^{\leftarrow}_t], \qquad y_t = W_y h_t + b_y.$$9 as potential label errors, denoted “abnormal,” adding them back to training in Stage 2 feature selection (Zhang et al., 5 Sep 2025). The source further specifies that CL identifies mislabeled or ambiguous samples by comparing predicted versus true labels across cross-validation folds, uses no additional loss beyond standard cross-entropy, and operates purely in preprocessing and feature selection to remove or flag noisy points.

IFS completes the feature-selection stack. Features are first ranked by IG, then added one at a time while classifier performance is evaluated on a held-out split; the selected dimensionality $z_t = \sigma(W_z[x_t;h_{t-1}] + b_z),$0 is the point at which accuracy peaks (Zhang et al., 5 Sep 2025). In operational terms, this makes TrailGate’s feature pipeline not merely filter-based but filter-plus-wrapper.

4. Data augmentation and preprocessing workflow

TrailGate begins with preprocessing that converts raw records into encoded and Min–Max scaled inputs. The summary specifies 41 features for NSL-KDD, comprising 3 discrete and 38 continuous features (Zhang et al., 5 Sep 2025). Labels are also encoded in the pseudocode description of the pipeline.

The principal augmentation method is ADASYN, described as Adaptive Synthetic Sampling. It oversamples all minority classes—DoS, Probe, U2R, and R2L—up to the level of the majority class. For each minority sample $z_t = \sigma(W_z[x_t;h_{t-1}] + b_z),$1, the method finds its $z_t = \sigma(W_z[x_t;h_{t-1}] + b_z),$2-nearest neighbors, computes a local density term $z_t = \sigma(W_z[x_t;h_{t-1}] + b_z),$3 as the ratio of different-class neighbors, normalizes

$z_t = \sigma(W_z[x_t;h_{t-1}] + b_z),$4

and determines the total number of synthetic samples as

$z_t = \sigma(W_z[x_t;h_{t-1}] + b_z),$5

It then generates

$z_t = \sigma(W_z[x_t;h_{t-1}] + b_z),$6

new points per $z_t = \sigma(W_z[x_t;h_{t-1}] + b_z),$7 according to

$z_t = \sigma(W_z[x_t;h_{t-1}] + b_z),$8

The stated purpose is to balance class distribution before the two-stage classification (Zhang et al., 5 Sep 2025).

Within the overall workflow, ADASYN precedes the Random Forest and BiGRU+Transformer stages. The preprocessing and augmentation sequence is therefore not ancillary but constitutive of the TrailGate definition: encoding and scaling produce the 41-dimensional representation; ADASYN addresses class imbalance; CL addresses label noise; and IG, PCC, and IFS determine the feature subsets supplied to the stage-specific classifiers (Zhang et al., 5 Sep 2025).

5. Algorithmic pipeline and training protocol

The source provides a pseudocode-style outline of TrailGate. The input is raw training data $z_t = \sigma(W_z[x_t;h_{t-1}] + b_z),$9 and test data $r_t = \sigma(W_r[x_t;h_{t-1}] + b_r),$0. Preprocessing computes

$r_t = \sigma(W_r[x_t;h_{t-1}] + b_r),$1

and label encoding gives $r_t = \sigma(W_r[x_t;h_{t-1}] + b_r),$2. Augmentation then produces

$r_t = \sigma(W_r[x_t;h_{t-1}] + b_r),$3

Feature filtering proceeds by computing IG scores, sorting features, computing PCC and dropping high-PCC features of lower IG, and running CL on $r_t = \sigma(W_r[x_t;h_{t-1}] + b_r),$4 to obtain an abnormal subset $r_t = \sigma(W_r[x_t;h_{t-1}] + b_r),$5 (Zhang et al., 5 Sep 2025).

In the IFS stage, $r_t = \sigma(W_r[x_t;h_{t-1}] + b_r),$6 is merged with $r_t = \sigma(W_r[x_t;h_{t-1}] + b_r),$7, split into 70/30 train/validation partitions, and features are added incrementally in IG order until the best validation accuracy is obtained, yielding feature set $r_t = \sigma(W_r[x_t;h_{t-1}] + b_r),$8. Stage 1 then trains

$r_t = \sigma(W_r[x_t;h_{t-1}] + b_r),$9

fits it on $$\hat{h}_t = \tanh(W_h[x_t; r_t \odot h_{t-1}] + b_h),$$0, and predicts $$\hat{h}_t = \tanh(W_h[x_t; r_t \odot h_{t-1}] + b_h),$$1 (Zhang et al., 5 Sep 2025).

Stage 2 optionally repeats IG, PCC, CL, and IFS to obtain $$\hat{h}_t = \tanh(W_h[x_t; r_t \odot h_{t-1}] + b_h),$$2, and then trains the BiGRU+Transformer on the abnormal subset $$\hat{h}_t = \tanh(W_h[x_t; r_t \odot h_{t-1}] + b_h),$$3 using 10-fold cross-validation, batch size 512, 9 epochs, Adam, and cross-entropy. During inference, the test data are preprocessed, optionally augmented or not, projected onto $$\hat{h}_t = \tanh(W_h[x_t; r_t \odot h_{t-1}] + b_h),$$4, classified by $$\hat{h}_t = \tanh(W_h[x_t; r_t \odot h_{t-1}] + b_h),$$5, restricted to the abnormal subset, projected onto $$\hat{h}_t = \tanh(W_h[x_t; r_t \odot h_{t-1}] + b_h),$$6, and finally classified by the BiGRU+Transformer to produce $$\hat{h}_t = \tanh(W_h[x_t; r_t \odot h_{t-1}] + b_h),$$7 (Zhang et al., 5 Sep 2025).

This explicit staging distinguishes TrailGate from single-pass end-to-end systems. A plausible implication is that the framework is intended to reduce the burden on the deep model by confining it to cases already screened as suspicious by the Random Forest layer.

6. Empirical evaluation

TrailGate is evaluated on NSL-KDD, specifically KDDTrain+, KDDTest+, and KDDTest-21, and was also tested on UNSW-NB15 in follow-up (Zhang et al., 5 Sep 2025). The metrics reported are Accuracy, Precision, Recall, Specificity, FAR (False Alarm Rate), and F1-score. Implementation details given for the two stages are 300 trees for the Random Forest and, for the BiGRU+Transformer, batch size 512, 9 epochs, Adam with learning rate $$\hat{h}_t = \tanh(W_h[x_t; r_t \odot h_{t-1}] + b_h),$$8, and 10-fold cross-validation (Zhang et al., 5 Sep 2025).

The NSL-KDD results reported for binary classification are 94.10% on KDDTest+ and 91.59% on KDDTest-21, compared with approximately 92–93% for the best prior methods. For multi-class classification, the reported results are 85.81% on KDDTest+ and 71.32% on KDDTest-21, compared with approximately 83–84% and 66–82% in prior work. The summary further reports significant F1 gains on R2L, up to approximately 64.8%, and competitive U2R performance, approximately 11.9% (Zhang et al., 5 Sep 2025).

On the cross-dataset evaluation using UNSW-NB15, TrailGate reports 92.83% binary accuracy and 78.65% multi-class accuracy, again matching or exceeding prior art (Zhang et al., 5 Sep 2025). Because the source identifies these as cross-dataset results and notes follow-up testing on UNSW-NB15, this suggests that the framework’s performance claims are not restricted to a single benchmark family.

7. Ablations, novelty, and interpretation

The ablation results attribute measurable gains to each major component of the framework. According to the summary, each module—ADASYN, IG+PCC, CL, IFS, and the two-stage RF→BT design—contributes a 3–10% accuracy gain, and the optimal PCC thresholds are 0.7 for binary classification and 0.9 for multi-class classification (Zhang et al., 5 Sep 2025). These findings situate TrailGate as a composite system whose reported performance depends on the interaction of augmentation, denoising, feature filtering, wrapper-style subset selection, and staged classification.

The novelty of TrailGate is summarized in four points: a two-stage RF → BiGRU+Transformer cascade; a universal feature-selection pipeline combining IG, PCC, CL, and IFS; ADASYN for balanced training; and confident learning to filter label noise (Zhang et al., 5 Sep 2025). The source also states that the framework can identify common attack types and detect and mitigate emerging threats, and that the algorithmic fusion excels at common and well-understood attack types while having the ability to identify and neutralize emerging threats that stem from existing paradigms.

A common misconception in reading such a system would be to treat the deep model as the sole determinant of performance. The specification does not support that interpretation: TrailGate is defined as an integrated framework in which the Random Forest front end, feature-selection stack, augmentation strategy, and confident-learning procedure are all named contributors to the final results (Zhang et al., 5 Sep 2025). Another possible misconception would be to assume that confident learning alters the training objective; the source explicitly states that no additional loss is introduced and that CL is used purely in preprocessing and feature selection.

Taken as a whole, TrailGate is best understood as a staged intrusion-detection architecture that combines classical ensemble learning, sequence modeling, self-attention, synthetic oversampling, correlation-aware feature pruning, and cross-validation-based noisy-label identification within a single benchmarked workflow (Zhang et al., 5 Sep 2025).