## 1 Introduction  
Wireless Sensor Networks (WSNs) have become indispensable for monitoring and detecting critical environmental events such as forest fires, earthquakes, tsunamis, and border intrusions. These networks consist of distributed sensor nodes that continuously collect and transmit environmental data, enabling real-time decision making and rapid emergency response [1]. In the case of forest fire detection, WSNs offer a cost-effective and scalable solution by monitoring key environmental parameters--such as temperature, humidity, smoke, and light--in remote and often inaccessible locations. By detecting early warning signs such as sudden temperature spikes or abnormal smoke levels, WSNs can trigger timely alerts and help prevent large-scale disasters [2]. However, as WSNs become more widespread and integral to critical applications, ensuring their security and reliability has become a major challenge. Sensor malfunctions and network intrusions pose serious threats to data integrity, leading to false alarms or, worse, missed detections. Large-scale WSNs, often composed of hundreds or thousands of sensor nodes, are particularly vulnerable. These nodes are typically deployed in unprotected environments, making them susceptible to physical tampering, environmental damage,and cyberattacks [3, 4]. Additionally, the wireless communication medium exposes these networks to interception, jamming, and false data injection attacks, which can compromise the accuracy of forest fire detection systems [5, 6]. Therefore, an effective anomaly detection framework must not only identify deviations from normal sensor behavior but also distinguish between sensor malfunctions and external intrusions to ensure accurate classification and mitigation. Traditional anomaly detection methods in WSNs rely on statistical models, clustering algorithms, and rule-based systems, but they often struggle to adapt to dynamic environmental conditions and large-scale sensor deployments [7]. Recent advances in machine learning and deep learning, particularly Autoencoders, have shown great promise in learning complex patterns from sensor data and detecting anomalies. Transformer-based Autoencoders, in particular, leverage self-attention mechanisms to capture spatiotemporal dependencies, making them well-suited for processing time-series data in WSNs [8, 9]. However, while Autoencoders effectively detect anomalies, they do not inherently distinguish between malfunctions and intrusions, which is a crucial requirement for reliable WSN security and fire detection [10]. To address this gap, we propose a hybrid anomaly detection framework that integrates:  
A Transformer-based Autoencoder to learn normal sensor behavior and detect anomalies based on reconstruction errors. Adaptive thresholding to dynamically adjust anomaly sensitivity based on recent data trends. Isolation Forest, an unsupervised anomaly detection model, to validate anomalies and provide an initial classification. And XGBoost, a supervised learning classifier, to refine anomaly classification and differentiate between sensor malfunctions and intrusions. By combining these techniques, our approach not only detects anomalies more effectively but also ensures precise classification, reducing false positives and improving real-time decision making. Experimental results demonstrate that our hybrid framework achieves 95% accuracy, significantly improving intrusion detection and malfunction identification compared to conventional methods. The insights gained from this research extend beyond forest fire monitoring and can be applied to other domains such as IoT security, industrial process monitoring, and healthcare anomaly detection, where identifying both hardware failures and external cyber threats is crucial [11, 12].