Self-supervised network intrusion detection method based on multi-scale feature fusion
By employing a self-supervised network intrusion detection method based on multi-scale feature fusion, and combining local fine-grained and global topology-aware subgraph comparative learning, this approach addresses the problem of a single feature extraction perspective in existing technologies, enabling efficient detection and real-time online analysis of complex attacks.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2026-01-28
- Publication Date
- 2026-04-14
AI Technical Summary
Existing network intrusion detection methods suffer from a single perspective in feature extraction, making it difficult to comprehensively characterize the multi-scale complex patterns of network attacks, resulting in insufficient detection capabilities for complex attacks.
A self-supervised network intrusion detection method based on multi-scale feature fusion is adopted. By combining local fine-grained semantic contrastive learning and global topology-aware subgraph contrastive learning with graph neural networks, a network traffic graph is constructed to achieve adaptive fusion of local node and global subgraph features.
It achieves efficient detection of complex attacks, improves detection capabilities, and enables real-time online analysis without the need for manual data labeling, adapting to the data scarcity in real network environments.
Smart Images
Figure CN121864459A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the fields of computer network security and deep learning technology, and in particular to a self-supervised network intrusion detection method based on multi-scale feature fusion. Background Technology
[0002] Network intrusion detection systems (IDS) are a key component of network security protection systems, designed to monitor network traffic in real time, identify potential attacks, and issue timely alerts. With the widespread adoption of IoT devices, their security in dynamic and resource-constrained environments is becoming increasingly prominent. While traditional intrusion detection methods based on supervised and semi-supervised learning have achieved significant results, their performance heavily relies on large amounts of labeled data. However, real-world network environments are complex and variable, and labeling is costly and subject to strict privacy restrictions, resulting in a scarcity of labeled data and making it difficult for models to effectively identify new attack patterns.
[0003] Therefore, self-supervised learning techniques that do not require manual annotation, especially contrastive learning paradigms, have gradually become a research focus. However, existing intrusion detection methods based on contrastive learning have significant limitations in feature extraction, mainly in their singular perspective on feature utilization and failure to effectively integrate information from different scales of network traffic.
[0004] One type of method is based on Euclidean structures such as convolutional neural networks, which focuses on extracting local fine-grained features from data packets or stream sequences. However, it is difficult to model the complex topological relationships between network entities, and therefore it is not capable of detecting large-scale cooperative attacks (such as DDoS) that require a global perspective.
[0005] Another type of method, while using graph neural networks to model the network topology in a non-Euclidean way, often focuses on single-level feature learning in its design. Some methods only focus on local neighborhood semantics through node-level comparison. Although they can capture fine-grained anomalies, they are difficult to perceive the propagation pattern of attacks in the global topology. Other methods only emphasize the consistency of the global structure through subgraph or graph-level comparison. Although they can detect macroscopic anomalies, they are prone to losing the local contextual information needed to accurately locate the source and path of attacks.
[0006] In summary, existing methods generally rely on a single level of feature representation, resulting in limited discriminative power of the learned feature representations and an inability to fully characterize the complex patterns of network attacks at multiple scales.
[0007] In view of this, we propose a self-supervised network intrusion detection method based on multi-scale feature fusion to solve the existing problems. Summary of the Invention
[0008] The purpose of this invention is to provide a self-supervised network intrusion detection method based on multi-scale feature fusion to solve the problems mentioned in the background art.
[0009] To achieve the above objectives, the present invention provides the following technical solution: a self-supervised network intrusion detection method based on multi-scale feature fusion, comprising the following steps:
[0010] S1. Construction and Data Initialization of Network Traffic Graph: Extract key features from the original network traffic, construct a network traffic graph containing node and edge attributes, and form initial graph data that the model can process;
[0011] S2, Local Fine-Grained Semantic Contrastive Learning: Using the network traffic graph constructed in S1 as input, a shared graph encoder is used to extract preliminary feature representations of nodes; by constructing a contrastive learning task, the model is driven to learn to distinguish between positive and negative samples, so that the feature representations of similar nodes are close to each other in the vector space, and the feature representations of dissimilar nodes are far apart; the model outputs a node feature representation matrix that captures local network interactions and anomalies.
[0012] S3. Global Topology-Aware Subgraph Contrastive Learning: The complete network traffic graph is divided into multiple cohesive subgraphs using a community detection algorithm. For each subgraph, the features of all nodes within it are summarized and enhanced through an aggregation mechanism to generate an overall feature representation of the subgraph. Positive and negative sample pairs are formed during contrastive learning. A global contrastive loss function is constructed by introducing a weight matrix that considers the topological similarity between subgraphs, driving the model to learn and distinguish the overall behavioral patterns of different subgraphs. Finally, a subgraph feature representation matrix reflecting the global network topology and attack distribution patterns is output.
[0013] S4. Adaptive fusion of multi-scale features: Adaptively fuse the obtained local node features with the global subgraph features; design a learnable fusion weight parameter, and perform weighted summation of the two types of features based on this weight to generate a multi-scale fusion feature representation;
[0014] S5. Edge Representation Construction and Intrusion Detection Classification: Based on the fused node features, for each edge in the graph, the fused features of the two nodes it connects are concatenated and combined with the original attribute features of the edge itself; the combined information is mapped into the final representation vector of the edge through a neural network; this edge representation is input into a classifier to determine whether the network flow belongs to normal traffic or a specific attack type.
[0015] S6. System Deployment and Real-time Detection: The trained model is deployed in a real network monitoring environment; the system dynamically constructs a traffic graph for the real-time collected network traffic, and sequentially performs feature extraction, local and global comparative learning, multi-scale feature fusion and edge classification steps to achieve online analysis and detection of new traffic.
[0016] Furthermore, in S1, key features include source address, destination address, port, protocol type, number of bytes, and TCP flag information.
[0017] Furthermore, in S1, during the construction of the network traffic graph, the communication entities in the network are abstracted as nodes of the graph, the communication flows between entities are abstracted as edges of the graph, and the traffic characteristics are assigned to the corresponding edges.
[0018] Furthermore, in S1, during the initialization of graph data formation, categorical features are numerically encoded and numerical features are standardized.
[0019] Furthermore, in S2, for any central node in the graph, all its directly connected neighboring nodes are taken as positive samples and regarded as similar nodes; at the same time, several non-neighboring nodes are randomly selected from the graph as negative samples and regarded as dissimilar nodes.
[0020] Furthermore, in S3, the aggregation mechanism includes graph attention networks.
[0021] Furthermore, in S3, during contrastive learning, different augmented views of the same subgraph are used to form positive sample pairs, while feature representations from different subgraphs are used to form negative sample pairs.
[0022] Furthermore, in S4, the fusion weight parameters dynamically adjust the proportion of local and global features in the final representation based on the input flow characteristics.
[0023] Furthermore, in S5, the entire model undergoes self-supervised learning during training by jointly optimizing the local contrastive loss and the global contrastive loss, without requiring any manually labeled data throughout the process.
[0024] Furthermore, in S6, once attack traffic is identified, the system immediately triggers an alarm mechanism and records the attack information, thereby completing a closed-loop network security protection from detection to alarm.
[0025] Compared with the prior art, the beneficial effects of the present invention are:
[0026] 1. This invention achieves effective fusion of multi-scale features and comprehensively models complex attack patterns. By designing and co-optimizing two modules, local node-level contrastive learning and global subgraph-level contrastive learning, within the same graph neural network framework, it overcomes the limitation of existing methods having a single feature learning perspective. The model can simultaneously capture fine-grained local interaction anomalies and macroscopic global topological anomalies, thereby forming a more comprehensive and in-depth representation of network attacks and significantly improving the detection capability for complex, covert, and novel attacks.
[0027] 2. This invention constructs a more discriminative unsupervised feature representation; the proposed dual-contrast learning paradigm, without any traffic labels, drives the model to learn highly distinguishable feature embeddings through a carefully designed positive and negative sample construction strategy and a dynamic weighting mechanism that introduces topological awareness; this makes normal traffic and various attack traffic more clearly separated in the representation space, laying a solid foundation for subsequent high-precision classification.
[0028] 3. This invention improves the practicality and deployment flexibility of the system; this method is entirely based on self-supervised learning, eliminating the dependence on large amounts of expensive and difficult-to-obtain labeled data, and is more adaptable to the current situation of scarce labeled data in real network environments; at the same time, the model has high training and inference efficiency, which can meet the needs of real-time or near-real-time detection in actual scenarios; the final end-to-end detection system can directly and automatically analyze and classify network flows, and output interpretable alarm information, which is easy to integrate into existing security protection systems. Attached Figure Description
[0029] Figure 1 This is a flowchart illustrating the overall process of a self-supervised network intrusion detection method based on multi-scale feature fusion according to the present invention.
[0030] Figure 2 This is a schematic diagram illustrating the working principle of the Local Fine-Grained Semantic Comparison Learning (FDSC) module of the present invention;
[0031] Figure 3 This is a schematic diagram illustrating the working principle of the Global Topology Aware Subgraph Comparison Learning (TASC) module of the present invention;
[0032] Figure 4 For performance comparison of different methods;
[0033] Figure 5 The classification results are for NF-BoT-IoT and NF-BoT-IoT v2;
[0034] Figure 6 The classification results are for NF-CSE-CIC IDS2018 and NF-CSE-CIC IDS2018-v2. Detailed Implementation
[0035] The technical solution of the present invention will be further described below with reference to the accompanying drawings and specific embodiments.
[0036] Example 1
[0037] A self-supervised network intrusion detection method based on multi-scale feature fusion, comprising the following steps:
[0038] S1. Construction and Data Initialization of Network Traffic Graph: First, key features are extracted from the raw network traffic, including source address, destination address, port, protocol type, number of bytes, and TCP flag information. Communication entities in the network (such as hosts) are abstracted as nodes of the graph, and the communication flows between entities are abstracted as edges of the graph. Traffic features are assigned to the corresponding edges, thereby constructing a network traffic graph containing node and edge attributes. Subsequently, categorical features are numerically encoded, and numerical features are standardized to form initial graph data that the model can process.
[0039] S2, Local Fine-Grained Semantic Contrastive Learning: This step aims to learn the fine-grained behavioral patterns of each node and its immediate neighbors in the network. Using the network traffic graph constructed in the previous step as input, a shared graph encoder is used to extract preliminary feature representations of the nodes. For any central node in the graph, all its directly connected neighbors are considered positive samples, assuming they have similar semantics in the local context. Simultaneously, several non-neighboring nodes are randomly selected from the graph as negative samples. By constructing a contrastive learning task, the model is driven to learn to distinguish between positive and negative samples, thereby bringing the feature representations of similar nodes closer together in the vector space and dissimilar nodes further apart. After this optimization step, the model outputs a node feature representation matrix that can capture the details of local network interactions and subtle anomalies.
[0040] S3. Global Topology-Aware Subgraph Contrastive Learning: This step aims to understand the macroscopic structure of network traffic and the propagation patterns of attacks. First, the complete network traffic graph is divided into multiple cohesive subgraphs using a community detection algorithm. For each subgraph, the features of all nodes within it are summarized and enhanced through aggregation mechanisms such as graph attention networks to generate the overall feature representation of the subgraph. In the contrastive learning, different enhanced views of the same subgraph are paired as positive samples, while feature representations from different subgraphs are paired as negative samples. By introducing a weight matrix that considers the topological similarity between subgraphs, a global contrastive loss function is constructed to drive the model to learn and distinguish the overall behavioral patterns of different subgraphs. This step ultimately outputs a subgraph feature representation matrix that reflects the global network topology and attack distribution patterns.
[0041] S4. Adaptive Fusion of Multi-Scale Features: To comprehensively utilize local details and global structural information, this step adaptively fuses the previously obtained local node features with global subgraph features. A learnable fusion weight parameter is designed, which can dynamically adjust the proportion of local and global features in the final representation according to the specific input traffic features. Subsequently, the two types of features are weighted and summed according to this weight to generate a unified and more discriminative multi-scale fusion feature representation. This feature retains the local context required for anomaly localization and also contains the global perspective required for identifying large-scale attack patterns.
[0042] S5. Edge Representation Construction and Intrusion Detection Classification: Network intrusion ultimately manifests as abnormal network connections (edges). Based on the fused node features, for each edge in the graph, the fused features of the two nodes it connects are concatenated and combined with the edge's original attribute features. Subsequently, a lightweight neural network maps this combined information into the final representation vector of the edge. This edge representation is input into a classifier to determine whether the network flow belongs to normal traffic or a specific attack type. During training, the entire model undergoes self-supervised learning by jointly optimizing local and global contrastive losses, requiring no manually labeled data throughout the process.
[0043] S6. System Deployment and Real-time Detection: The trained model is deployed in a real-world network monitoring environment. The system dynamically constructs a traffic graph from the real-time collected network traffic and sequentially performs feature extraction, local and global comparative learning, multi-scale feature fusion, and edge classification steps to achieve online analysis and detection of new traffic. Once attack traffic is identified, the system immediately triggers an alarm mechanism and records relevant attack details, thereby completing a closed-loop network security protection from perception to alarm.
[0044] The working principle of the self-supervised network intrusion detection method based on multi-scale feature fusion in Example 1 is as follows:
[0045] like Figure 1 As shown, network traffic data is generated based on source address, destination address, label, attack, etc. After being processed by the Local Fine-Grained Semantic Contrast Learning (FDSC) module, feature fusion is performed. Then, after being processed by the Global Topology Aware Subgraph Contrast Learning (TASC) module, optimized features are generated. Finally, the features are fused, a linear layer is applied, and an activation function (Sigmod) is applied before the prediction is output.
[0046] like Figure 2 As shown, the global graph and original features are input into the Local Fine-Grained Semantic Contrast Learning (FDSC) module. The main encoder is formed through momentum encoder and momentum update, and the learned features are generated by clustering pseudo-labels. Positive and negative samples including node features and edge features are then generated. After generating local node features, feature fusion is performed to form global features.
[0047] like Figure 3 As shown, in the Global Topology Aware Subgraph Contrast Learning (TASC) module, the subgraph is aggregated with the input feature slices and adjacency matrix using the GAT encoder to generate positive and negative sample pairs, thereby generating global features.
[0048] Figures 4-6This diagram illustrates the performance comparison between the method of this application and existing technologies on a typical dataset. As can be seen, the method of this application has advantages in precision, recall, and F1 score on typical datasets.
[0049] S1's data acquisition and graph structure construction transforms raw network traffic data into attribute graph structure data that can be processed by the model. The specific steps include data acquisition and feature extraction, attribute graph construction, and data preprocessing. In data acquisition and feature extraction, network flow records are collected, and the feature vector of each flow is extracted, which can be represented as: The first four items are used to construct the graph structure, while the rest serve as attribute features for nodes or edges. In constructing the attribute graph, each independent IP address is mapped to a graph node, forming a node set V; each network flow corresponds to an edge, where u and v are the nodes corresponding to the source IP and destination IP, respectively; the edge feature matrix consists of the attribute features of each flow, and the initial node features can be set as a constant vector or simple degree-based statistics. In data preprocessing, the categorical features in the edge features are one-hot encoded, and the numerical features are standardized. , where μ and σ are the mean and standard deviation of the feature on the training set, respectively.
[0050] The model initialization in S1 applies to the shared encoder, projector head, momentum encoder, fusion module, and classifier. In the shared encoder, the graph encoder fθ is initialized, for example, using stacked layers of a graph attention network (GAT). ,in It is the attention coefficient. This is a learnable weight matrix. In the projection head, the local projection head... With global projection head All are multilayer perceptrons (MLPs), implemented as follows: Where σ is the activation function. In the momentum encoder, the momentum encoder fξ and fθ have the same structure, and their parameters are initialized as follows: In the fusion module and classifier, the fusion weight generation module is implemented as follows: MLP edge classifier edge It also adopts a similar MLP structure.
[0051] Model training and optimization include Local Contrastive Learning (FDSC) in S2 and Global Contrastive Learning (TASC) in S3, as well as momentum update and joint optimization. In Local Contrastive Learning (FDSC) in S2, for node v, the positive samples are its first-order neighbors: Negative samples are randomly selected from k nodes that are not neighbors: Contrast loss in the form of InfoNCE: Where s(·) is the cosine similarity and τ is the temperature hyperparameter. In S3's Global Comparative Learning (TASC), the Louvain algorithm is used to divide the graph into K subgraphs. For each subgraph, its enhanced representation is obtained through GAT aggregation: Positive samples are two augmented views of the same subgraph, while negative samples come from different subgraphs. The global contrastive loss is defined as: In momentum update and joint optimization, the momentum encoder parameter update formula is: Where m is usually taken as 0.999, the total loss is: Update all parameters using the Adam optimizer.
[0052] Feature fusion and intrusion detection inference include scale feature fusion in S4 and edge representation construction and classification in S5. In scale feature fusion in S4, local node feature matrices are extracted from the trained model. and global subgraph feature matrix And merge them in the following manner: α is dynamically calculated by the fusion module. This represents element-wise multiplication. In the edge representation construction and classification of S5, for edges... Its representation is constructed as follows: ,in and From , The original edge features are used to obtain the predicted category through a softmax classifier: .
[0053] In the system deployment and real-time monitoring of S6, the above process is deployed as an executable system. With a time window of T, the system collects traffic and constructs a graph Gt every T seconds, sequentially performing graph encoding and feature extraction, local and global feature generation, multi-scale feature fusion, edge classification and anomaly detection, and outputting alarm logs. The system supports real-time dashboard display and alarm push notifications, achieving closed-loop security protection.
[0054] The above specific embodiments are merely several preferred embodiments of the present invention. Based on the technical solutions of the present invention and the relevant teachings of the above embodiments, those skilled in the art can make various alternative improvements and combinations to the above specific embodiments.
Claims
1. A self-supervised network intrusion detection method based on multi-scale feature fusion, characterized in that the steps are as follows: include: S1. Construction and Data Initialization of Network Traffic Graph: Extract key features from the original network traffic, construct a network traffic graph containing node and edge attributes, and form initial graph data that the model can process; S2, Local Fine-grained Semantic Contrast Learning: Using the network traffic graph constructed in S1 as input, a shared graph encoder is used to extract preliminary feature representations of nodes; by constructing a contrastive learning task, the model is driven to learn to distinguish between positive and negative samples, so that the feature representations of similar nodes are close to each other in the vector space, and the feature representations of dissimilar nodes are far apart from each other. The model outputs a node feature representation matrix that captures local interactions and anomalies in the network; S3. Global Topology-Aware Subgraph Comparison Learning: The complete network traffic graph is divided into multiple cohesive subgraphs using a community detection algorithm. For each subgraph, the features of all nodes within it are summarized and enhanced through an aggregation mechanism to generate the overall feature representation of the subgraph. In contrastive learning, positive and negative sample pairs are constructed. By introducing a weight matrix that considers the topological similarity between subgraphs, a global contrastive loss function is built to drive the model to learn and distinguish the overall behavior patterns of different subgraphs. Finally, a subgraph feature representation matrix that reflects the global topology and attack distribution of the network is output. S4. Adaptive fusion of multi-scale features: Adaptively fuse the obtained local node features with the global subgraph features; Design a learnable fusion weight parameter, and use this weight to perform a weighted summation of the two types of features to generate a multi-scale fusion feature representation; S5. Edge Representation Construction and Intrusion Detection Classification: Based on the fused node features, for each edge in the graph, the fused features of the two nodes it connects are concatenated and combined with the original attribute features of the edge itself; the combined information is mapped into the final representation vector of the edge through a neural network; this edge representation is input into a classifier to determine whether the network flow belongs to normal traffic or a specific attack type. S6. System Deployment and Real-time Detection: Deploy the trained model in a real network monitoring environment; The system dynamically constructs a traffic map from the real-time collected network traffic and sequentially performs feature extraction, local and global comparative learning, multi-scale feature fusion, and edge classification steps to achieve online analysis and detection of new traffic.
2. The self-supervised network intrusion detection method based on multi-scale feature fusion according to claim 1, characterized in that: In S1, key features include source address, destination address, port, protocol type, number of bytes, and TCP flags.
3. The self-supervised network intrusion detection method based on multi-scale feature fusion according to claim 1, characterized in that: In S1, during the construction of the network traffic graph, the communication entities in the network are abstracted as nodes of the graph, the communication flows between entities are abstracted as edges of the graph, and the traffic characteristics are assigned to the corresponding edges.
4. The self-supervised network intrusion detection method based on multi-scale feature fusion according to claim 1, characterized in that: In S1, during the initialization of graph data formation, categorical features are numerically encoded and numerical features are standardized.
5. The self-supervised network intrusion detection method based on multi-scale feature fusion according to claim 1, characterized in that: In S2, for any central node in the graph, all its directly connected neighboring nodes are taken as positive samples and considered as similar nodes; at the same time, several non-neighboring nodes are randomly selected from the graph as negative samples and considered as dissimilar nodes.
6. The self-supervised network intrusion detection method based on multi-scale feature fusion according to claim 1, characterized in that: In S3, the aggregation mechanism includes graph attention networks.
7. The self-supervised network intrusion detection method based on multi-scale feature fusion according to claim 1, characterized in that: In S3, during contrastive learning, different augmented views of the same subgraph are used to form positive sample pairs, while feature representations from different subgraphs are used to form negative sample pairs.
8. The self-supervised network intrusion detection method based on multi-scale feature fusion according to claim 1, characterized in that: In S4, the fusion weight parameters dynamically adjust the proportion of local and global features in the final representation based on the input flow characteristics.
9. The self-supervised network intrusion detection method based on multi-scale feature fusion according to claim 1, characterized in that: In S5, the entire model undergoes self-supervised learning during training by jointly optimizing the local contrastive loss and the global contrastive loss, without requiring any manually labeled data throughout the process.
10. The self-supervised network intrusion detection method based on multi-scale feature fusion according to claim 1, characterized in that: In S6, once attack traffic is identified, the system immediately triggers an alarm mechanism and records the attack information, thus completing a closed-loop network security protection from detection to alarm.