Intrusion detection method based on multi-modal feature fusion and attention refining

Abstract

The invention discloses an intrusion detection method based on multi-modal feature fusion and attention refining. The method comprises the following steps: uniformly mapping high-dimensional heterogeneous input to a standard feature space through an initial feature extraction module; secondly, designing a parallel multi-modal processing architecture, and respectively capturing time sequence long-range dependence, short-range dynamic and local spatial modes by utilizing a long-short-term memory network, a gating circulation unit and a convolutional neural network branch; a double-path attention refining module is introduced, and multi-modal features are adaptively fused and noise is suppressed through the synergistic effect of global semantic attention and local detail suppression attention; and finally, realizing accurate attack identification through a classification head. According to the method, deep complementation and adaptive optimization of multi-modal features are effectively realized, and the perception and discrimination capability of an intrusion detection system on complex and hidden threats is remarkably improved.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of artificial intelligence and network intrusion detection technology, and particularly relates to an intrusion detection method based on multi-modal feature fusion and attention refinement. BACKGROUND

[0002] In the face of growing network threats, the detection accuracy, generalization ability and practicality of traditional intrusion detection systems are severely tested when dealing with high-dimensional, imbalanced traffic data and resource-constrained edge computing environments. Deep learning technology, with its powerful feature learning and pattern recognition capabilities, provides a new path for building a more intelligent and adaptive security protection system. In recent years, research has expanded from single performance improvement to robust learning for imbalanced data, cross-scenario general-purpose model construction, and lightweight terminal deployment, among other cutting-edge directions, collectively driving the in-depth development of intrusion detection technology.

[0003] In terms of robust detection mechanisms for imbalanced data, research aims to address the model bias caused by the severe imbalance between normal and abnormal samples in real networks. Zhang et al. proposed the MIM detection model, which effectively alleviates the impact of class imbalance through multi-strategy ensemble learning: first, random oversampling and undersampling techniques are used to generate multiple balanced data subsets, and based on the simulated annealing algorithm, the most discriminative feature combinations are optimized for each subset, and finally the outputs of multiple base classifiers are integrated to obtain stable and less biased detection results, significantly improving the recall rate for minority class attacks. Liu and Xu et al. designed a detection framework based on contrastive learning and Bayesian Gaussian mixture model. The framework first pre-trains the encoder through contrastive learning to obtain a more robust vector representation of attack features, and then uses the Bayesian Gaussian mixture model to adaptively determine the clustering components of network traffic, accurately identifying unknown attack patterns. The innovation of this method lies in the combination of representation learning and probabilistic modeling, which has shown excellent generalization performance on highly imbalanced datasets.

[0004] In terms of general model architecture and cross-scenario feature learning, research focuses on constructing deep learning models that can understand the internal correlations of complex traffic. Ma et al. proposed the XMF-GNN framework, which innovatively uses heterogeneous graph neural networks to model network traffic: the model first constructs the original traffic data into a heterogeneous graph structure containing packet-level nodes and flow-level nodes, and then dynamically fuses information at different levels through a gated attention mechanism, thereby capturing the spatial dependence between micro-packet sequences and macro-flow behavior features. This fine-grained feature learning approach enables high detection accuracy in various network environments. Andresini et al. developed the ROULETTE model, which takes a different technical path: the core is to convert one-dimensional network flow data into two-dimensional grayscale images to mine spatial features. First, a convolutional neural network is used to learn spatial features from the generated traffic images. Then, a pixel-level attention mechanism is introduced to generate a heat map that identifies key feature areas. The model uses a multi-task learning architecture, with a main branch performing fine-grained attack classification and an auxiliary branch performing normal / abnormal binary classification. Joint optimization improves overall performance and decision interpretability.

[0005] In terms of lightweight and adaptive detection technology for resource-constrained environments, to achieve efficient deployment of intrusion detection at the edge, research emphasizes the efficiency and continuous learning ability of the model. Yang et al. proposed a dynamic open-set intrusion detection method suitable for industrial Internet of Things scenarios. The method balances detection capability and computational overhead through a three-stage process: first, a variational autoencoder is used to learn the feature representation of known attacks and complete the initial classification model construction. Then, based on reconstruction error, the extreme value theory is used to identify unknown attack samples that have not appeared in the training set. Finally, knowledge distillation technology is used to transfer the knowledge of the complex teacher model to the lightweight student model, achieving model miniaturization and dynamic updating, ensuring that terminal devices with limited computing resources can also have continuous defense capabilities against new attacks.

[0006] Although the existing technology has made significant progress in various frontiers of network intrusion detection, these methods still have a series of limitations in practical application, mainly due to the singularity of their technical path and the locality of their optimization goal, failing to fully coordinate the balance between detection accuracy, generalization ability, and computational efficiency. For example, in terms of robust detection mechanisms for data imbalance, existing methods such as the MIM detection model proposed by Zhang et al. alleviate class bias through multi-strategy ensemble learning, which improves the recall rate for minority class attacks, but the model complexity is high, relying on the integration of multiple base classifiers and the feature optimization process, resulting in a significant increase in computational overhead, making it difficult to deploy in edge environments with high real-time requirements. The fundamental reason is that the ensemble learning strategy needs to generate multiple data subsets and train models in parallel. This redundant design enhances stability, but introduces additional resource consumption, and optimization steps such as simulated annealing algorithms may prolong training time and reduce model update efficiency. Similarly, the framework based on contrastive learning and Bayesian Gaussian mixture model proposed by Liu and Xu et al. can improve generalization performance through representation learning, but it is sensitive to the quality and distribution assumptions of pre-training data. If the network traffic experiences non-stationary changes, the clustering components of the Bayesian model may not be able to adapt, leading to misjudgment of unknown attacks. This is mainly because these methods rely on fixed probability priors and lack a dynamic gating mechanism to real-time correct feature representation, making the model insufficiently robust in complex and variable network environments.

[0007] In terms of general model architecture and cross-scene feature learning, existing technologies such as the XMF-GNN framework proposed by Ma et al. use heterogeneous graph neural networks to capture multi-level traffic features, innovatively integrating packet-level and flow-level information. However, the model construction process requires pre-defining complex graph structures such as node relationships and attention weights, which increases implementation difficulty and requires higher data preprocessing, potentially introducing bias due to inconsistent graph construction in actual deployment. The reason is that heterogeneous graph models rely on hand-designed topology rules and cannot learn the intrinsic relationships of traffic end-to-end. Especially when the network scale expands, dynamic maintenance of the graph structure becomes a bottleneck, limiting the model's cross-scene migration ability. The ROULETTE model developed by Andresini et al. converts traffic into images and applies CNN and attention mechanisms, which can extract spatial features. However, the one-dimensional to two-dimensional conversion process may lose key timing information in the original traffic, such as the dynamic pattern of packet arrival intervals, weakening the model's ability to detect time-series-based attacks such as slow DDoS. This is mainly because image processing focuses on spatial locality and ignores the continuous time-series dependence of network traffic. Moreover, although the multi-task learning architecture improves interpretability, auxiliary tasks may distract the attention of the main classifier, leading to resource waste and decision delay.

[0008] In the aspect of lightweight and adaptive detection technology for resource-constrained environment, the existing method such as the dynamic open set intrusion detection proposed by Yang et al. uses variational autoencoder and knowledge distillation to realize model miniaturization, although the calculation overhead and detection ability are balanced, but the distillation process may oversimplify the model parameters, loss the fine-grained features in the teacher model, resulting in the decrease of the discriminability to the slight variant attack, the root of which lies in that the knowledge distillation relies on the fixed weight migration, and cannot dynamically adjust the fusion strategy according to the real-time traffic changes, and the open set detection identifies unknown attacks based on reconstruction error, if the training data is not fully covered, the extreme value theory may produce false alarm, and the system reliability is weakened. In addition, these lightweight methods mostly focus on offline optimization, lack online learning mechanism, when facing new attacks or traffic drift, the model needs to be retrained to adapt, which is due to the static deployment architecture failing to integrate the continuous learning cycle, so that the long-term practicability on the edge device is limited, and the real adaptive protection cannot be realized. In general, the shortcomings of the existing technology are mostly caused by the local optimization in the model design, and the global cooperation cannot be realized through the parallel extraction of multi-modal features and attention-driven refinement, so that the detection blind area and efficiency bottleneck are exposed in the complex network environment.

[0009] In summary, how to overcome the limitations of the existing intrusion detection technology in the feature extraction, fusion and refinement links is urgent to be solved. SUMMARY

[0010] The main purpose of the present application is to overcome the shortcomings and deficiencies of the prior art, provide an intrusion detection method based on multi-modal feature fusion and attention refinement, realize efficient cooperative extraction and adaptive fusion of multi-modal features of network traffic, and establish a refinement mechanism that can simultaneously strengthen global attack patterns and local key fingerprints, to improve the detection performance in complex attack scenarios.

[0011] In order to achieve the above purpose, the technical scheme adopted by the present application is as follows:

[0012] In the first aspect, the present application provides an intrusion detection method based on multi-modal feature fusion and attention refinement, comprising the following steps:

[0013] Map the high-dimensional heterogeneous input to the same standard feature space, and obtain complementary features by using a multi-modal architecture; the multi-modal architecture comprises a plurality of heterogeneous network branches, and the heterogeneous network branches process in parallel;

[0014] Obtain global features and local features by using a double-path attention mechanism, fuse the global features and the local features, and obtain a discriminative vector; the double-path attention mechanism comprises a global semantic attention path and a local detail suppression path;

[0015] The discriminative vector is mapped to the final classification decision space through a multilayer perceptron to obtain the intrusion detection result.

[0016] As a preferred technical solution, the method of obtaining complementary features using a multimodal architecture includes: reconstructing the standardized feature matrix into a heterogeneous network branch, mining complementary information of the standardized feature matrix from different angles using the heterogeneous network branch, and fusing the complementary information through a splicing operation to obtain complementary features.

[0017] As a preferred technical solution, the method of utilizing heterogeneous network branches to mine complementary information of input features from different perspectives in the time series specifically involves:

[0018] The standardized feature matrix is ​​reconstructed into a time series, and the long short-term memory network is used to process the long-range temporal dependencies in the time series to obtain the hidden state of the last time step.

[0019] Short-range dynamic features are obtained by processing the standardized feature matrix using a gated loop unit.

[0020] The standardized feature matrix is ​​converted into a one-dimensional spatial sequence, and a convolutional network is used to perform hierarchical convolution operations on the one-dimensional convolutional sequence to obtain local spatial features.

[0021] As a preferred technical solution, the convolutional network includes two levels of convolution. The first level of convolution uses 32 3×1 convolutional kernels and performs feature compression through max pooling to obtain basic spatial features. The second level of convolution uses 64 3×1 convolutional kernels to process the basic spatial features to obtain high-level spatial patterns, and outputs local spatial features through global pooling and fully connected layers.

[0022] As a preferred technical solution, the step of obtaining global and local features from complementary features through a dual-path attention mechanism, and fusing the global and local features to obtain a discriminative vector, includes:

[0023] The complementary features are extended into a three-dimensional tensor through an expansion operation, and then transposed to obtain transposed features. After aligning the channel dimensions, a one-dimensional convolution operation is performed on the transposed features to obtain high-frequency features.

[0024] The global semantic attention pathway involves using high-frequency features as queries, keys, and values ​​as inputs to calculate global contextual associations and obtain global features by reversing and restoring the high-frequency features.

[0025] The local detail suppression pathway utilizes a spatial attention mechanism to filter high-frequency features, obtains a spatially sensitive mask through a fully connected layer and a Sigmoid, performs element-wise gating suppression on the spatially sensitive mask, and obtains local features.

[0026] By using a dynamic gating mechanism, global and local features are concatenated, and content-aware weights are obtained based on the concatenated features. Global and local features are then weighted and fused based on the content-aware weights to obtain fused features.

[0027] The fused features are compressed along the sequence dimension and the discriminative dimension is expanded by linear projection to obtain the discriminative vector.

[0028] As a preferred technical solution, the transpose operation is performed to obtain the transpose feature, as shown in the following formula:

[0029] ,

[0030] Where X represents the transpose feature, X.tranpose(·) represents the transpose operation, and B is the batch size.

[0031] As a preferred technical solution, the spatially sensitive mask is obtained through a fully connected layer and a sigmoid function, and element-wise gating suppression is performed on the spatially sensitive mask to obtain local features, as shown in the following equation:

[0032] ,

[0033] ,

[0034] Where σ(·) represents the activation function, W1 represents the weight matrix, and H high Let b1 represent the high-frequency feature, b1 represent the bias vector, and M represent the high-frequency feature. local H represents a space-sensitive mask. local Indicates local features.

[0035] As a preferred technical solution, the method of using a dynamic gating mechanism to concatenate global and local features, and obtaining content-aware weights based on the concatenated features, specifically:

[0036] Using a dynamic gating mechanism, global and local features are concatenated, as shown in the following equation:

[0037] ,

[0038] in, H represents the splicing feature. global H represents global features. local Indicates local features;

[0039] The content-aware weight is as follows:

[0040] ,

[0041] Where G represents content-aware weight, W g Let b represent the weight matrix. gThis represents the bias vector.

[0042] As a preferred technical solution, the step of obtaining fused feature H by weighting and fusing global and local features based on content-aware weights is described. fused As shown in the following formula:

[0043] ,

[0044] Where G represents content-aware weight, H global H represents global features. local Indicates local features.

[0045] As a preferred technical solution, the step of compressing the fused features along the sequence dimension and expanding the discriminative dimension through linear projection to obtain the discriminative vector is as follows:

[0046] Compression along the sequence dimension, as shown below:

[0047] ,

[0048] Among them, H pool This represents compressed features, where T represents the sequence dimension. H represents the t-th feature in the sequence dimension, squeeze(1) represents the compression operation, and H fused Indicates fusion characteristics;

[0049] The discriminative dimension is extended by linear projection, as follows:

[0050] ,

[0051] Among them, W p Let b represent the weight matrix. p This represents the bias vector.

[0052] Compared with the prior art, the present invention has the following advantages and beneficial effects:

[0053] (1) The parallel multimodal feature extraction mechanism adopted in this invention processes features at different levels through LSTM, GRU, and CNN branches respectively. Unlike the limitations of existing single-path models, this mechanism achieves deep collaborative mining of attack fingerprints. In specific implementation, after the input features are standardized, they are processed in parallel by each branch. LSTM captures long-term dependencies, GRU focuses on short-term dynamics, and CNN extracts local spatial patterns, ensuring the comprehensiveness and complementarity of feature extraction. It has significant advantages in feature extraction, and can comprehensively capture multimodal features in network traffic, including long-range temporal dependencies, short-range dynamic changes, and local spatial correlations, thereby effectively avoiding detection blind spots.

[0054] (2) This invention demonstrates superior adaptive capabilities in the feature refinement stage, dynamically balancing global semantics and local details to improve the accuracy of identifying complex attack patterns. This advantage stems from the introduced hierarchical attention refinement strategy, which includes the synergistic effect of global semantic attention and local detail suppression attention. Unlike the bias problem of existing single attention mechanisms, this method achieves adaptive enhancement of key features and noise suppression. This method calculates global contextual correlation and spatially sensitive mask through a dual-path attention module, enabling the model to automatically adjust its focus according to the traffic context, thus enhancing its ability to handle distributed attacks and local fluctuations.

[0055] (3) This invention achieves dynamic optimization in feature fusion, which can balance the contribution of multimodal features according to the real-time traffic context, thereby enhancing the robustness of the model in noisy environments. This advantage is attributed to the developed adaptive weighted fusion module, which generates content-aware weights through a gating mechanism. Unlike traditional fixed fusion strategies such as simple splicing or linear superposition, this module achieves adaptive integration of multimodal features. In the specific process, global and local features are spliced ​​and then dynamically weighted, enabling the model to automatically adjust feature weights for different attack types, thus optimizing the fusion effect.

[0056] (4) This invention achieves a good balance between computational efficiency and model performance, ensuring high detection accuracy while reducing computational overhead and improving deployment feasibility in resource-constrained edge environments. This advantage is attributed to the technical means of optimizing model structure and attention computation path. Unlike existing methods such as the high complexity or lightweight model feature loss of ensemble learning, this invention achieves efficient operation through simplified network design and regularization. The decision optimization module uses a multilayer perceptron and cross-entropy loss function, combined with training iteration, to ensure that the model maintains accuracy while reducing resource consumption and supporting real-time threat perception. Attached Figure Description

[0057] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0058] Figure 1 This is a flowchart of an intrusion detection method based on multimodal feature fusion and attention refinement according to an embodiment of the present invention;

[0059] Figure 2 This is a schematic diagram of the multimodal feature parallel extraction and fusion module according to an embodiment of the present invention;

[0060] Figure 3This is a schematic diagram of the attention-driven feature refinement module according to an embodiment of the present invention;

[0061] Figure 4 This is a schematic diagram of the decision optimization and detection closed-loop module in an embodiment of the present invention. Detailed Implementation

[0062] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are merely some embodiments of the present application, and not all embodiments. All other embodiments obtained by those skilled in the art based on the embodiments of the present application without creative effort are within the scope of protection of the present application.

[0063] In this application, the reference to "embodiment" means that a specific feature, structure, or characteristic described in connection with an embodiment may be included in at least one embodiment of this application. The appearance of this phrase in various places throughout the specification does not necessarily refer to the same embodiment, nor is it a mutually exclusive, independent, or alternative embodiment. It will be explicitly and implicitly understood by those skilled in the art that the embodiments described in this application can be combined with other embodiments.

[0064] Please see Figure 1 This embodiment provides an intrusion detection method based on multimodal feature fusion and attention refinement, including the following steps:

[0065] S1. Map the high-dimensional heterogeneous input to the standard feature space and use a multimodal architecture to obtain complementary features; the multimodal architecture includes multiple heterogeneous network branches, which are processed in parallel.

[0066] Step S1 is implemented through a multimodal feature parallel extraction and fusion module, such as... Figure 2 As shown in the diagram, this module is responsible for learning a unified representation of the input features and extracting complementary features using multimodal architectures such as recurrent neural networks and convolutional neural networks to complete the initial fusion.

[0067] The specific steps of step S1 are as follows:

[0068] S12, First, analyze the network traffic feature matrix. (Includes traffic characteristics such as IP address, port, and protocol type, where B is the batch size.) A non-linear transformation is performed (to the size of the feature dimension). The input data first passes through a fully connected layer, reducing the feature dimension from... The dimension is expanded to 256. A batch normalization layer standardizes the feature distribution, and the ReLU activation function introduces non-linear feature representation. A Dropout layer randomly masks neurons with a probability of 0.2 to prevent overfitting. The second fully connected layer compresses the 256-dimensional features to the target dimension of 128. Batch normalization is used again to adjust the data distribution, and the ReLU activation function reinforces the non-linear relationships. The final output is a fixed-dimensional feature matrix. This enables the transformation of inputs of any dimension into a standardized feature space.

[0069] S12, Output of the normalized feature matrix The input is fed into a parallel multimodal processing module. This module uses three heterogeneous network branches to mine complementary information from different perspectives, thereby achieving effective extraction of multimodal features.

[0070] To adapt to the input requirements of the time series model, the feature matrix Y is first reconstructed into a time series form. Specifically, this is done by adding a dimension to the original feature matrix. Convert to The 128 feature dimensions were reconstructed into 128 time steps, each containing one feature value. This reshaping allows each feature dimension to be treated as an independent time step, facilitating subsequent temporal models to capture the temporal dependencies between features.

[0071] The LSTM branch is specifically designed to capture long-range temporal dependencies in network traffic, which is crucial for identifying complex attack patterns spanning multiple time steps. LSTM achieves selective memorization and forgetting of historical information through its sophisticated gating mechanism. Its core computational process is as follows:

[0072]

[0073] In the formula, These represent the input gate, forget gate, and output gate, respectively. and These represent the candidate cell state and the final cell state at the current moment, respectively; Indicates the current hidden state; , Let b be the weight matrix, b* be the bias vector, σ and tanh be the activation functions, and ⊙ denote element-wise multiplication. This branch processes the complete sequence and outputs the hidden state at the last time step. This effectively preserves long-term temporal context information.

[0074] The GRU branch focuses on extracting short-range dynamic features from network behavior, and its simplified gating structure makes it more sensitive to recent pattern changes. GRU achieves rapid adaptation to short-term temporal patterns through the coordinated operation of reset and update gates.

[0075] ,

[0076] In the formula, and These represent the reset gate and the update gate, respectively; they control the degree to which historical information is retained and updated. , Let b be the weight matrix and b* be the bias vector. This branch outputs... It captures the rapid dynamic change patterns of traffic characteristics.

[0077] To adapt to the processing requirements of convolutional neural networks, the input features are... Reshape it into a form suitable for one-dimensional convolution. Specifically, through... The implementation uses a structure where the second dimension represents the number of channels (initially 1 channel) and the third dimension represents the sequence length (128 feature points). This reshaping allows the CNN to treat the 128 features as a one-dimensional spatial sequence, facilitating spatial pattern extraction by the convolutional kernel along the feature dimension.

[0078] The CNN branch is specifically designed to uncover local spatial correlations between features, identifying spatial patterns at different scales through hierarchical convolutional operations. This branch employs a two-stage convolutional architecture, with the core convolutional operation represented as follows:

[0079] ,

[0080] In the formula, b, c, and l represent the batch index, output channel index, and sequence position index, respectively; i and k iterate over the input channels and convolutional kernels; W is the convolutional kernel weight, and b is the bias. The first-level convolution uses 32 3×1 convolutional kernels to extract basic spatial features, followed by feature compression through max pooling. The second-level convolution uses 64 3×1 convolutional kernels to further mine high-level spatial patterns, and finally outputs the data through global pooling and a fully connected layer. This effectively captures the local correlations between features.

[0081] Finally, the three features are merged through a splicing operation:

[0082] ,

[0083] This fusion feature incorporates long-range temporal dependencies, short-range dynamic changes, and local spatial patterns, providing a rich multimodal feature foundation for subsequent attention refinement.

[0084] S2. The complementary features are processed through a dual-path attention mechanism to obtain global and local features, and the global and local features are fused to obtain a discriminative vector; the dual-path attention mechanism includes a global semantic attention path and a local detail suppression path.

[0085] Step S2 involves the attention-driven feature refinement module, such as... Figure 3 As shown, this part is responsible for refining the fused multimodal high-dimensional features. It uses a dual-path attention mechanism to collaboratively capture global context and local details, dynamically integrates the advantages of both to suppress noise and enhance key features, and aggregates the refined sequence features into a fixed-dimensional discriminative vector.

[0086] The specific implementation method is as follows:

[0087] S21, Input Features First, it is expanded into a three-dimensional tensor through the unsqueeze(1) operation. To adapt to the requirements of convolution operations. In intrusion detection tasks, high-frequency features often correspond to key attack patterns (such as burst traffic from port scanning) and need to be specifically enhanced. This is achieved through a transpose operation:

[0088] ,

[0089] After aligning the channel dimensions, perform a one-dimensional convolution:

[0090] ,

[0091] The structure is then restored by inversion. This process extracts burst traffic patterns through the local perceptual properties of convolutional kernels, compressing the feature dimension from 256 to 64 while preserving high-frequency attack features.

[0092] S22. For global behavioral patterns of network intrusions (such as the distributed collaborative characteristics of DDoS attacks), multi-head attention is used to model long-range dependencies. As inputs to Query, Key, and Value, calculate the global context association:

[0093] ,

[0094] The attention weight matrix Explicitly captures feature interactions across traffic packets, enhancing the ability to detect distributed attacks. The output dimensions remain unchanged, but each feature vector incorporates global traffic semantics.

[0095] S23. To address local noise in network traffic (such as normal traffic fluctuations), a spatial attention mechanism is designed for feature selection. A spatially sensitive mask is generated using a fully connected layer and a sigmoid function.

[0096] ,

[0097] Perform element-wise gating suppression:

[0098] ,

[0099] This operation dynamically decays irrelevant local fluctuations (such as TCP retransmission noise) based on feature confidence, strengthens key attack fingerprints (such as malicious payload features), and keeps the feature dimension unchanged at 64.

[0100] S24. To balance the contributions of global attack patterns and local attack fingerprints, a dynamic gating mechanism is designed. Dual-path feature splicing is employed. Generate content-aware weights:

[0101] ,

[0102] Weighted fusion of global and local features:

[0103] ,

[0104] Gating value It adapts to traffic characteristics, for example, focusing on global behavior for port scanning attacks and strengthening local payload characteristics for SQL injection attacks.

[0105] S25. To generate a fixed-dimensional attack feature vector, first compress it along the sequence dimension:

[0106] ,

[0107] Among them, H pool This represents compressed features, where T represents the sequence dimension. This represents the t-th feature in the sequence dimension;

[0108] Extending the discriminative dimension through linear projection:

[0109] ,

[0110] This process refines multimodal features into a 128-dimensional attack representation vector, providing a highly discriminative input for the classifier and completing the end-to-end mapping from raw traffic features to intrusion decisions.

[0111] S3. Map the discriminative vector to the final classification decision space through a multilayer perceptron to obtain the intrusion detection result.

[0112] Step S3 is implemented by the decision optimization and detection closed-loop module, such as... Figure 4 As shown in the diagram, this part is responsible for mapping the refined discriminative vectors to the final classification decision space through a multilayer perceptron, outputting the intrusion detection result. After training and iterative optimization, the best model is selected and deployed in the network system for real-time threat perception.

[0113] The specific steps are as follows:

[0114] S31. The refined discriminant vector The input is fed into the ClassificationHead module, which constructs the decision space using a multilayer perceptron structure. This includes feature dimension expansion, batch normalization, non-linear activation, and Dropout regularization. Ultimately, it maps 128-dimensional discriminative features to the class space and outputs a classification probability distribution to support intrusion detection decisions. The formula is expressed as:

[0115] ,

[0116] in, For the prediction result, C represents the number of categories. This process achieves a nonlinear transformation from high-dimensional features to the decision space through fully connected layers and activation functions, ensuring that the output is discriminative.

[0117] S32. During the training phase, the cross-entropy loss function is used to quantize the predicted output. With real labels The differences between them are addressed by combining the Adam optimizer for backpropagation and parameter updates. Through multiple iterations, the loss function is minimized to optimize model weights. Dropout and weight decay are used to prevent overfitting and improve generalization ability. The formula is expressed as:

[0118] ,

[0119] in, One-hot encoding for the real label. To predict probabilities, the optimization process adjusts the model parameters using gradient descent until it converges to a steady state.

[0120] After model training, the optimal parameters (such as learning rate, hidden layer size, etc.) are selected based on the validation set accuracy, and the model is deployed to the network environment. During online inference, real-time network traffic data is input into the initial feature extraction module, which maps features of arbitrary dimensions to 128 dimensions, and outputs the results after parallel processing and feature refinement. Finally, the detection results are output through the classification head, realizing a closed loop of real-time threat perception.

[0121] It should be noted that, for the sake of simplicity, the aforementioned method embodiments are all described as a series of actions. However, those skilled in the art should understand that the present invention is not limited to the described order of actions, because according to the present invention, some steps can be performed in other orders or simultaneously.

[0122] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0123] The above embodiments are preferred embodiments of the present invention, but the embodiments of the present invention are not limited to the above embodiments. Any changes, modifications, substitutions, combinations, or simplifications made without departing from the spirit and principle of the present invention shall be considered equivalent substitutions and shall be included within the protection scope of the present invention.

Claims

1. An intrusion detection method based on multi-modal feature fusion and attention refinement, characterized in that, The method comprises the following steps: The high-dimensional heterogeneous input is mapped to a standard feature space, and complementary features are obtained by using a multi-modal architecture; the multi-modal architecture comprises a plurality of heterogeneous network branches which are processed in parallel; The complementary features are processed by a double-path attention mechanism to obtain global features and local features, the global features and the local features are fused to obtain a discriminative vector; the double-path attention mechanism comprises a global semantic attention path and a local detail suppression path; The discriminative vector is mapped to a final classification decision space by a multi-layer perception to obtain an intrusion detection result.

2. The intrusion detection method based on multi-modal feature fusion and attention refinement according to claim 1, characterized in that, The multi-modal architecture is used to obtain the complementary features, comprising: the standardized feature matrix is input into the heterogeneous network branches, and the heterogeneous network branches are used to mine complementary information of the standardized feature matrix from different angles respectively, the complementary information is fused by splicing operation to obtain the complementary features. 3.The intrusion detection method based on multi-modal feature fusion and attention refinement of claim 2, characterized in that, The heterogeneous network branches are used to mine the complementary information of the input features from different angles respectively, specifically: The standardized feature matrix is reconstructed into a time sequence, and the long-term time sequence dependence relationship in the time sequence is processed by using a long short-term memory network to obtain the hidden state of the last time step; The standardized feature matrix is processed by using a gated recurrent unit to obtain short-range dynamic features; The standardized feature matrix is converted into a one-dimensional spatial sequence, and a convolutional network is used to perform hierarchical convolution operation on the one-dimensional convolution sequence to obtain local spatial features.

4. The intrusion detection method based on multi-modal feature fusion and attention refinement according to claim 3, characterized in that, The convolutional network comprises two levels of convolution, the first level of convolution uses 32 3×1 convolution kernels and performs feature compression by maximum pooling to obtain basic spatial features; the second level of convolution uses 64 3×1 convolution kernels to process the basic spatial features to obtain high-level spatial patterns, and outputs the local spatial features through global pooling and a fully connected layer.

5. The intrusion detection method based on multi-modal feature fusion and attention refinement according to claim 1, characterized in that, The complementary features are expanded into three-dimensional tensors by expansion operation, and transposed features are obtained by transposition operation, after aligning the channel dimension, one-dimensional convolution operation is performed on the transposed features to obtain high-frequency features; The global semantic attention path is that the high-frequency features are recovered in structure by inverse transposition, the high-frequency features are taken as queries, keys and values as inputs, the global context association is calculated to obtain global features; The local detail suppression path is that the spatial attention mechanism is used to screen the high-frequency features, the spatial sensitive mask is obtained through the fully connected layer and Sigmoid, the element-wise gating suppression is performed on the spatial sensitive mask to obtain local features; The dynamic gating mechanism is used to splice the global features and the local features, and the content perception weight is obtained according to the spliced features, the global features and the local features are fused according to the content perception weight, and the fused features are obtained; The fused features are compressed along the sequence dimension, and the discriminative dimension is expanded by linear projection to obtain the discriminative vector. The transposed features are obtained by transposition operation as follows:

6. The intrusion detection method based on multi-modal feature fusion and attention refinement according to claim 5, characterized in that, Wherein, X represents the transposed features, X.transpose(·) represents the transposition operation, and B is the batch size. ， ​ 7. The intrusion detection method based on multi-modal feature fusion and attention refinement according to claim 5, characterized in that, The spatial sensitive mask is obtained by a full connection layer and a sigmoid, element-wise gating inhibition is performed on the spatial sensitive mask, and local features are obtained, as follows: ， ， where σ(·) denotes an activation function, W1denotes a weight matrix, H high denotes high-frequency features, b1denotes a bias vector, M local denotes a spatially sensitive mask, H local denotes local features. 8.The intrusion detection method based on multi-modal feature fusion and attention refinement of claim 5, characterized in that, The global features and the local features are spliced by using a dynamic gating mechanism, and content-aware weights are obtained according to the spliced features, specifically as follows: The global features and the local features are spliced by using a dynamic gating mechanism, as follows: ， wherein, denotes a stitching feature, H global denotes a global feature, H local denotes a local feature; The content-aware weights are as follows: ， where G represents a content-aware weight, W g represents a weight matrix, and b g represents a bias vector. 9.The intrusion detection method based on multi-modal feature fusion and attention refinement of claim 5, characterized in that, The global feature and the local feature are fused according to the content-aware weight to obtain a fusion feature H fused As follows: ， where G represents a content-aware weight, H global represents a global feature, and H local represents a local feature. 10.The intrusion detection method based on multi-modal feature fusion and attention refinement of claim 5, characterized in that, The fusion features are compressed along the sequence dimension, and discriminative dimensions are expanded by linear projection to obtain discriminative vectors, specifically as follows: The fusion features are compressed along the sequence dimension, as follows: ， wherein H pool denotes a compression feature, T denotes a sequence dimension size, denotes the tth feature on the sequence dimension, squeeze(1) denotes a compression operation, H fused denotes a fusion feature; Discriminative dimensions are expanded by linear projection, as follows: ， where W p represents a weight matrix, b p represents a bias vector.

Images