Explainable Transformer-Based Zero-Day Attack Detection in Next-Generation Networks: A Comprehensive Literature Review

Network Intrusion Detection Systems (IDSs) are a critical part of cybersecurity. However, there are still great challenges for IDSs to detect zero-day attacks and provide transparent and reliable decision support. Deep learning architectures based on transformers have achieved detection accuracies higher than 99% on several benchmark intrusion detection datasets. But the black-box nature of these models limits their practical use and raises concerns about interpretability, regulatory compliance, and user trust. We explore three main research directions: (1) performance of detection on benchmark datasets such as NSL-KDD, CICIDS2017, UNSW-NB15, CICIoT2023, and ToN-IoT; (2) explainability techniques, including SHAP, LIME, attention visualization, DeepLIFT, and Integrated Gradients; and (3) robustness against adversarial evasion attacks. Results show that hybrid supervised/unsupervised Transformer models outperform single model approaches consistently with some studies reporting improvements up to 18.6% in zero-day attack detection. Furthermore, the adversarial training can achieve the detection accuracies above 94% in the adversarial attack cases. Attention-based mechanisms offer inherent model interpretability, eliminating the necessity of post hoc explanation techniques. However, it remains challenging to generalize across datasets, and performance drops by roughly 10% to 40% when models are evaluated in network settings that are different from training. This review presents a practical deployment architecture based on the synthesized evidence, including Transformer inference, dual-method explainability (SHAP and LIME), and decision support at the Security Operations Center (SOC). It also discusses some open research challenges like standardized evaluation metrics for explainability, realistic benchmarks for adversarial robustness, and privacy-preserving federated learning frameworks for collaborative threat intelligence.