A network intrusion detection method based on multi-scale feature fusion
By mapping network traffic data into a two-dimensional matrix and constructing the SECA-Net network, selective efficient convolution and adaptive feature fusion blocks are used to solve the problems of high computational resource consumption and insufficient detection accuracy of existing network intrusion detection methods, thus achieving efficient network attack identification.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- ZHONGBEI UNIV
- Filing Date
- 2026-03-19
- Publication Date
- 2026-06-19
AI Technical Summary
Existing network intrusion detection methods consume large amounts of computational resources and have insufficient detection accuracy, making it difficult to effectively identify complex network attack patterns.
Gramian Angular Field (GAF) is used to map one-dimensional traffic sequences into two-dimensional matrix representations. A multi-stage cascaded hybrid visual network architecture, SECA-Net, is constructed. Selective efficient convolutional module (SE-Conv) and adaptive context feature fusion block (ACFB) are designed to improve detection performance through selective channel computation and adaptive feature fusion.
It significantly reduces computational complexity while improving the detection accuracy and generalization ability for complex attack patterns, achieving efficient intrusion detection.
Smart Images
Figure CN122247681A_ABST
Abstract
Description
Technical Field
[0002] The present invention relates to the fields of network security, deep learning and lightweight models, and in particular to a network intrusion detection method based on multi-scale feature fusion. Background Technology
[0004] With the rapid popularization of cloud computing, the Internet of Things (IoT), and the Industrial Internet, the scale and complexity of cyberattacks continue to rise. Cisco's annual cybersecurity report points out that the number of global cyberattacks has maintained a rapid growth trend in recent years, with advanced persistent threats (APTs), distributed denial-of-service (DDoS) attacks, and multi-stage hybrid attacks becoming among the main threat forms. Meanwhile, IBM's "Cost of a Data Breach Report" shows that the average recovery cost of data breaches continues to rise, and most attacks are difficult to detect in their early stages. Against this backdrop, building highly accurate and versatile intrusion detection systems (IDS) has become an important research topic in the field of cybersecurity.
[0005] In recent years, deep learning methods have demonstrated significant advantages in intrusion detection tasks due to their automatic feature learning capabilities. However, network traffic data is typically characterized by high dimensionality, high noise, and uneven distribution, making it difficult to fully extract its potential structural information by directly modeling raw traffic or statistical features. Therefore, designing effective data representation methods and constructing model structures that balance detection performance and computational efficiency are key challenges currently facing intrusion detection research. [1] Some researchers proposed a self-attention-based deep IDS framework, which improves the model's ability to perceive complex attack patterns by globally modeling traffic features. However, such methods typically have a large parameter scale and require significant computational resources and training data.
[0006] To overcome the limitations of traditional sequence modeling methods, some studies have begun to attempt to map network traffic into a two-dimensional image representation and introduce computer vision models for detection. (Wang) [2] Researchers converted network traffic byte sequences into grayscale images and used convolutional neural networks for classification, achieving high detection accuracy on the CIC-IDS2017 dataset. This method validated the feasibility of traffic visualization modeling, but its image construction method failed to fully preserve the temporal dependencies of the traffic. Subsequently, researchers introduced time-series visualization techniques to enhance representation capabilities. [3]Zhang et al. proposed a method for encoding time series using Gramian Angular Field (GAF), which can preserve temporal correlations in a two-dimensional matrix and demonstrates good performance in multiple time series classification tasks. In the field of intrusion detection, Zhang... [4] Researchers combined GAF with deep CNNs to model the statistical features of network traffic, achieving detection results superior to traditional CNNs on the UNSW-NB15 dataset. However, this method relies on convolutional networks with large parameter sizes, resulting in high computational complexity.
[0007] [1] SHOONE N, NGUYEN N, PHAN T, et al. A deep learning approach to network intrusion detection[J]. IEEE Transactions on Emerging Topics in Computational Intelligence, 2018, 2(1): 41–50.
[0008] [2] WANG W, ZHU M, WANG J, et al. Malware traffic classification using convolutional neural network for representation learning[J]. 2017International Conference on Information Networking (ICOIN), 2017: 712–717.
[0009] [3] HATAMI N, GHAREHGHAH SI, FARAHANI F V. Classification of time-series images using deep convolutional neural networks[J]. Proceedings of theTenth International Conference on Machine Vision, 2017.
[0010] [4] ZHANG J, LI C, ZHAO Y, et al. Network intrusion detection based on Gramian Angular Field and deep convolutional neural networks[J]. IEEEAccess, 2020, 8: 13047–13058. Summary of the Invention
[0012] This invention provides a network intrusion detection method based on multi-scale feature fusion to address the above-mentioned problems, thereby solving the issues of high computational resource consumption and insufficient detection accuracy in existing network intrusion detection methods.
[0013] To solve the above problems, the present invention adopts the following technical solution:
[0014] A network intrusion detection method based on multi-scale feature fusion, characterized by comprising steps S110-S150:
[0015] S110: The raw network traffic data is preprocessed, and then the Gramian Angular Field (GAF) method is used to map the one-dimensional traffic sequence into a two-dimensional matrix representation;
[0016] S120: Constructing a multi-stage cascaded hybrid visual network architecture for SECA-Net;
[0017] S130: Design a Selective Efficient Convolution (SE-Conv) module to reduce redundant convolution operations through selective channel computation mechanism;
[0018] S140: Design an Adaptive Context Aggregation Block (ACFB) to aggregate contextual information from multi-level features;
[0019] S150: Train the constructed intrusion detection classification model and provide the classification results.
[0020] In the data processing, the network traffic data is first cleaned and its features extracted. Then, the Gramian Angular Field (GAF) method is used to map the one-dimensional traffic sequence into a two-dimensional matrix representation. The input sequence is then normalized using the following formula:
[0021]
[0022] Mapping to polar coordinate space Then construct the GAF matrix. ,in This process explicitly encodes temporal dependencies into spatial structure information, providing a suitable input format for subsequent visual feature modeling.
[0023] The SECA-Net network structure consists of five processing stages (Stages 1-5), lightweight feature encoding, global feature modeling, adaptive feature fusion, and a classification decision module. Its end-to-end mapping relationship is as follows:
[0024]
[0025] in This represents the overall feature transformation process through five processing stages. This is the final classification decision function.
[0026] The core data flow of the model is:
[0027]
[0028]
[0029]
[0030] At the beginning of each stage, GhostModule is used for lightweight channel upscaling and spatial downsampling. In Stages 1-2, the model performs progressive feature extraction through multi-layer SE-Conv, gradually building a multi-level representation from low-level statistical features to mid-level behavioral patterns. Starting from Stage 3, the model introduces the ACFB module for adaptive fusion of multi-scale features, enhancing its ability to model the global context.
[0031] In the SE-Conv module, the input features are first processed. Divide it into channels Groups:
[0032]
[0033] The first two groups each account for One channel, the last group occupies One channel. For each group SE-Conv further divides the channel into two equal parts, focusing only on the first half of the channel. Apply standard 3×3 convolution operation to the second half of the channels. Maintain the identity mapping to preserve the original feature information:
[0034]
[0035] The outputs of the three groups are concatenated to obtain:
[0036]
[0037] Subsequently, information exchange is performed through a Channel Shuffle operation, and lightweight spatial and channel blending is achieved through depthwise separable convolution (DWConvPW), as shown in the following formula:
[0038]
[0039]
[0040] To further enhance the discriminative power of features, SE-Conv introduces a lightweight Squeeze-and-Excitation (SE) gating mechanism. This mechanism adaptively recalibrates the importance of each channel through global context modeling and generates channel-level weights using a two-layer small MLP and sigmoid activation. The features are weighted channel by channel, as shown in the following formula:
[0041]
[0042] Finally, SE-Conv normalizes features using BatchNorm and introduces a learnable residual scaling parameter λ∈(0,1) to perform residual fusion with the input features, achieving residual learning, as shown in the following formula:
[0043]
[0044] In the ACFB module, a Multi-Resolution Analyzer (MRA) and a Channel-wise Booster (CWB) are introduced during the feature fusion stage. This allows the network to adaptively adjust the importance of features at different spatial scales and in different channels based on the statistical properties of the input features. First, the feature is divided into two branches through a linear mapping for different feature processing purposes, as shown in the following formula:
[0045]
[0046] In the MRA and CWB, MRA is used for... Spatial downsampling (factor 8) is performed to obtain coarse-grained feature statistics, and these are then processed through learnable parameters. and The multi-scale weights are adaptively adjusted, then upsampled back to the original resolution, and gated modulation is performed using SiLU activation and linear mapping, as shown in the following formula:
[0047]
[0048]
[0049] in Perform 8x spatial downsampling. For channel-independent convolution, For along spatial dimensions Calculate the characteristic variance.
[0050] CWB uses a DMlp (Depthly Convolutional Multilayer Perceptron) to process the y-branch. This module performs a fully connected transformation in the channel dimension and a lightweight convolution operation along the spatial dimension, as shown in the following formula:
[0051]
[0052] Finally, the feature fusion process adds the outputs of the two branches, fusing the spatially adaptive global semantics. ) and local details ( ):
[0053]
[0054] In the training of the classification model, the cross-entropy loss function is used for end-to-end training, and the optimization objective is:
[0055]
[0056] in The number of training samples. For the first The true class labels (one-hot encoded) of each sample. For the model to the first The first sample Predicted probability of class These are all the learnable parameters of the model.
[0057] The beneficial effects of this invention are:
[0058] The SE-Conv module, a local feature extractor designed in this invention, utilizes selective computation mechanism and depthwise separable convolution to extract fine-grained attack features while eliminating channel redundancy. The designed adaptive context feature fusion block (ACFB) significantly improves the model's ability to perceive global context and complex covert attacks by dynamically aggregating multi-scale features at different levels. Attached Figure Description
[0060] Figure 1: A schematic diagram of the proposed SECA-Net multi-stage cascaded hybrid visual network architecture;
[0061] Figure 2 : A schematic diagram of the proposed SE-Conv module;
[0062] Figure 3 : A schematic diagram of the proposed ACFB module;
[0063] Figure 4 : A two-dimensional image of the raw traffic data after conversion using the GAF method;
[0064] Figure 5 The proposed model's performance on the BoT-IoT dataset is shown in a bar chart.
[0065] Figure 6 The confusion matrix of the model on the CIC UNSW-NB15 dataset;
[0066] Figure 7 The confusion matrix of the model on the BoT-IoT dataset; Detailed Implementation
[0068] The present invention will be described in detail below with reference to specific embodiments.
[0069] This invention provides a network intrusion detection method based on multi-scale feature fusion, including steps S110-S150:
[0070] S110: The raw network traffic data is preprocessed, and then the Gramian Angular Field (GAF) method is used to map the one-dimensional traffic sequence into a two-dimensional matrix representation;
[0071] S120: Constructing a multi-stage cascaded hybrid visual network architecture for SECA-Net;
[0072] S130: Design a Selective Efficient Convolution (SE-Conv) module to reduce redundant convolution operations through selective channel computation mechanism;
[0073] S140: Design an Adaptive Context Aggregation Block (ACFB) to aggregate contextual information from multi-level features;
[0074] S150: Train the constructed intrusion detection classification model and provide the classification results.
[0075] In the data processing, the network traffic data is first cleaned and its features extracted. Then, the Gramian Angular Field (GAF) method is used to map the one-dimensional traffic sequence into a two-dimensional matrix representation. The input sequence is then normalized using the following formula:
[0076]
[0077] Mapping to polar coordinate space Then construct the GAF matrix. ,in This process explicitly encodes temporal dependencies into spatial structure information, providing a suitable input format for subsequent visual feature modeling.
[0078] The SECA-Net network structure, as follows: Figure 1 As shown, the entire system consists of five processing stages (Stages 1-5), lightweight feature encoding, global feature modeling, adaptive feature fusion, and a classification decision module. Its end-to-end mapping relationship is as follows:
[0079]
[0080] in This represents the overall feature transformation process through five processing stages. This is the final classification decision function.
[0081] The core data flow of the model is:
[0082]
[0083]
[0084]
[0085] At the beginning of each stage, GhostModule is used for lightweight channel upscaling and spatial downsampling. In Stages 1-2, the model performs progressive feature extraction through multi-layer SE-Conv, gradually building a multi-level representation from low-level statistical features to mid-level behavioral patterns. Starting from Stage 3, the model introduces the ACFB module for adaptive fusion of multi-scale features, enhancing its ability to model the global context.
[0086] The SE-Conv module, such as Figure 2 As shown, firstly, the input features... Divide it into channels Groups:
[0087]
[0088] The first two groups each account for One channel, the last group occupies One channel. For each group SE-Conv further divides the channel into two equal parts, focusing only on the first half of the channel. Apply standard 3×3 convolution operation to the second half of the channels. Maintain the identity mapping to preserve the original feature information:
[0089]
[0090] The outputs of the three groups are concatenated to obtain:
[0091]
[0092] Subsequently, information exchange is performed through a Channel Shuffle operation, and lightweight spatial and channel blending is achieved through depthwise separable convolution (DWConvPW), as shown in the following formula:
[0093]
[0094]
[0095] To further enhance the discriminative power of features, SE-Conv introduces a lightweight Squeeze-and-Excitation (SE) gating mechanism. This mechanism adaptively recalibrates the importance of each channel through global context modeling and generates channel-level weights using a two-layer small MLP and sigmoid activation. The features are weighted channel by channel, as shown in the following formula:
[0096]
[0097] Finally, SE-Conv normalizes features using BatchNorm and introduces a learnable residual scaling parameter λ∈(0,1) to perform residual fusion with the input features, achieving residual learning, as shown in the following formula:
[0098]
[0099] The ACFB module, such as Figure 3 As shown, a multi-resolution analyzer (MRA) and a channel-wise booster (CWB) are introduced in the feature fusion stage. This allows the network to adaptively adjust the importance of features at different spatial scales and in different channels based on the statistical properties of the input features. First, the feature is divided into two branches through a linear mapping for feature processing of different purposes, as shown in the following formula:
[0100]
[0101] In the MRA and CWB, MRA is used for... Spatial downsampling (factor 8) is performed to obtain coarse-grained feature statistics, and these are then processed through learnable parameters. and The multi-scale weights are adaptively adjusted, then upsampled back to the original resolution, and gated modulation is performed using SiLU activation and linear mapping, as shown in the following formula:
[0102]
[0103]
[0104] in Perform 8x spatial downsampling. For channel-independent convolution, For along spatial dimensions Calculate the characteristic variance.
[0105] CWB uses a DMlp (Depthly Convolutional Multilayer Perceptron) to process the y-branch. This module performs a fully connected transformation in the channel dimension and a lightweight convolution operation along the spatial dimension, as shown in the following formula:
[0106]
[0107] Finally, the feature fusion process adds the outputs of the two branches, fusing the spatially adaptive global semantics. ) and local details ( ):
[0108]
[0109] In the training of the classification model, the cross-entropy loss function is used for end-to-end training, and the optimization objective is:
[0110]
[0111] in The number of training samples. For the first The true class labels (one-hot encoded) of each sample. For the model to the first The first sample Predicted probability of class These are all the learnable parameters of the model.
[0112] The following description, in conjunction with the accompanying drawings and embodiments, details the performance of this invention on the CIC UNSW-NB15 dataset and the BoT-IoT dataset, compared to other mainstream lightweight models, and the implementation process.
[0113] Example 1: Network Intrusion Detection Applied to the CIC UNSW-NB15 Dataset
[0114] The specific steps are as follows:
[0115] The first step involves data cleaning and feature extraction of the CIC UNSW-NB15 dataset. Then, the Gramian Angular Field (GAF) method is used to map the one-dimensional flow sequence into a two-dimensional matrix representation. The processed data is shown below. Figure 4 As shown, the dataset was finally divided into training and test sets in a 7:3 ratio.
[0116] The second step involves inputting the image and constructing and training the proposed SECA-Net network intrusion detection method based on multi-scale feature fusion. The specific steps are as follows:
[0117] First, the SE-Conv module is constructed, which divides the input features into three groups along the channel dimension. For each group, SE-Conv further bisects it along the channel dimension, applying a standard 3×3 convolution operation only to the first half of the channels, while maintaining an identity mapping for the second half of the channels to preserve the original feature information. The outputs of the three groups are then concatenated. Subsequently, information exchange is performed through the ChannelShuffle operation, and lightweight spatial and channel mixing is achieved through depthwise separable convolution (DWConvPW). To further enhance the discriminativeness of the features, SE-Conv introduces a lightweight Squeeze-and-Excitation (SE) gating mechanism, which adaptively recalibrates the importance of each channel through global context modeling. Channel-level weights are generated through two layers of small MLP and sigmoid activation, and the features are weighted channel by channel. Finally, SE-Conv normalizes the features through BatchNorm and introduces a learnable residual scaling parameter to perform residual fusion with the input features, achieving residual learning.
[0118] Secondly, an ACFB module is constructed, introducing a Multi-Resolution Analyzer (MRA) and a Channel-wise Booster (CWB) during the feature fusion stage. This allows the network to adaptively adjust the importance of features at different spatial scales and in different channels based on the statistical properties of the input features. First, the feature is divided into two branches through a linear mapping for different feature processing purposes; then, the MRA... Spatial downsampling (factor 8) is performed to obtain coarse-grained feature statistics, and these are then processed through learnable parameters. and The multi-scale weights are adaptively adjusted, and then the adjusted weights are upsampled back to the original resolution and gated modulation is performed through SiLU activation and linear mapping. CWB uses DMlp (Deep Convolutional Multilayer Perceptron) to process the y branch. This module performs fully connected transformation in the channel dimension and lightweight convolution operation along the spatial dimension. Finally, the feature fusion process adds the outputs of the two branches, fusing spatially adaptive global semantics and local details.
[0119] The third step is to train the model using the pre-defined training and test sets. The specific steps are as follows:
[0120] First, the original images from the training set are input into the network, and the output of the current iteration is obtained through computation. Then, the model output is compared with the corresponding segmentation results in the labels, and the loss value is calculated using a loss function. End-to-end training is performed using the cross-entropy loss function, with the optimization objective being:
[0121]
[0122] in The number of training samples. For the first The true class labels (one-hot encoded) of each sample. For the model to the first The first sample Predicted probability of class These are all the learnable parameters of the model. The process iterates until the loss value reaches a predetermined error requirement, ultimately resulting in a trained network model. Finally, the original test set images are input into the trained model to obtain the final segmentation result, which is then compared with the true labels on the test set to verify the model's performance. The experimental results of the SECA-Net network in this embodiment are shown in Table 1.
[0123] In Table 1, Params refers to the number of parameters, and FLOPs refers to the number of floating-point operations. These are lightweight metrics that examine the model's space and computational complexity. ACC refers to Accuracy, F1 refers to F1 score, R refers to Recall, and P refers to Precision. These four are model accuracy metrics used to test and evaluate the performance of the proposed model. It can be observed that SECA-Net achieves an effective balance between model complexity and its ability to identify network traffic on the CIC UNSW-NB15 dataset.
[0124] Table 1 Comparison of various metrics between the SECA-Net model and the lightweight model
[0125]
[0126] The confusion matrix output by the model in this study on the CIC UNSW-NB15 dataset is as follows: Figure 6 As shown in the diagram, the rows of the matrix represent the true categories, and the columns correspond to the predicted results. The main diagonal elements reflect the in-class detection accuracy, while the off-diagonal elements represent misclassifications. Benign samples were correctly identified, and 100% accurate detection was achieved for all five attack types: DoS, Fuzzers, Generic, Reconnaissance, and Shellcode. The accuracy rate for classifying Exploits was 99.4%, with 0.6% of samples misclassified as Generic attacks. This error may be due to some overlap between the behavioral patterns of some Exploits and Generic attacks.
[0127] Example 2: Network Intrusion Detection Applied to BoT-IoT Datasets
[0128] The implementation method is the same as in Example 1, and the specific steps are as follows:
[0129] The first step involves data cleaning and feature extraction of the BoT-IoT dataset. Then, the Gramian Angular Field (GAF) method is used to map the one-dimensional traffic sequence into a two-dimensional matrix representation. The processed data is shown below. Figure 4 As shown, the dataset was finally divided into training and test sets in a 7:3 ratio.
[0130] The second step involves inputting the image and constructing and training the proposed SECA-Net network intrusion detection method based on multi-scale feature fusion. The specific steps are as follows:
[0131] First, the SE-Conv module is constructed, which divides the input features into three groups along the channel dimension. For each group, SE-Conv further bisects it along the channel dimension, applying a standard 3×3 convolution operation only to the first half of the channels, while maintaining an identity mapping for the second half of the channels to preserve the original feature information. The outputs of the three groups are then concatenated. Subsequently, information exchange is performed through the ChannelShuffle operation, and lightweight spatial and channel mixing is achieved through depthwise separable convolution (DWConvPW). To further enhance the discriminativeness of the features, SE-Conv introduces a lightweight Squeeze-and-Excitation (SE) gating mechanism, which adaptively recalibrates the importance of each channel through global context modeling. Channel-level weights are generated through two layers of small MLP and sigmoid activation, and the features are weighted channel by channel. Finally, SE-Conv normalizes the features through BatchNorm and introduces a learnable residual scaling parameter to perform residual fusion with the input features, achieving residual learning.
[0132] Secondly, an ACFB module is constructed, introducing a Multi-Resolution Analyzer (MRA) and a Channel-wise Booster (CWB) during the feature fusion stage. This allows the network to adaptively adjust the importance of features at different spatial scales and in different channels based on the statistical properties of the input features. First, the feature is divided into two branches through a linear mapping for different feature processing purposes; then, the MRA... Spatial downsampling (factor 8) is performed to obtain coarse-grained feature statistics, and these are then processed through learnable parameters. and The multi-scale weights are adaptively adjusted, and then the adjusted weights are upsampled back to the original resolution and gated modulation is performed through SiLU activation and linear mapping. CWB uses DMlp (Deep Convolutional Multilayer Perceptron) to process the y branch. This module performs fully connected transformation in the channel dimension and lightweight convolution operation along the spatial dimension. Finally, the feature fusion process adds the outputs of the two branches, fusing spatially adaptive global semantics and local details.
[0133] The third step is to train the model using the pre-defined training and test sets. The specific steps are as follows:
[0134] First, the original images from the training set are input into the network, and the output of the current iteration is obtained through computation. Then, the model output is compared with the corresponding segmentation results in the labels, and the loss value is calculated using a loss function. End-to-end training is performed using the cross-entropy loss function, with the optimization objective being:
[0135]
[0136] in The number of training samples. For the first The true class labels (one-hot encoded) of each sample. For the model to the first The first sample Predicted probability of class These are all the learnable parameters of the model. This process iterates until the loss value reaches a predetermined error requirement, ultimately resulting in a trained network model. Finally, the original test set images are input into the trained model to obtain the final segmentation result, which is then compared with the true labels on the test set to verify the model's performance. The experimental results of the SECA-Net network in this embodiment are as follows: Figure 5 As shown, ACC, F1, R, and P are 99.97%, 99.95%, 99.94%, and 99.96%, respectively.
[0137] Figure 7 This is the confusion matrix output by the model on the BoT-IoT dataset. The accuracy rate for classifying DoS attacks is 99.5%, with 0.5% of samples misclassified as DDoS attacks. This is because both attacks exhibit high concurrency and large packet transmission characteristics, leading to high similarity in local texture between the converted GAF 2D images. All other samples achieved 100% accurate identification, validating the GAF conversion mechanism and demonstrating visual separability between normal and attack traffic.
[0138] It should be understood that those skilled in the art can make improvements or modifications based on the above description, and all such improvements and modifications should fall within the protection scope of the appended claims.
Claims
1. A network intrusion detection method based on multi-scale feature fusion, characterized in that, Including steps S110-S150: S110: The raw network traffic data is preprocessed, and then the Gramian Angular Field (GAF) method is used to map the one-dimensional traffic sequence into a two-dimensional matrix representation; S120: Constructing a multi-stage cascaded hybrid visual network architecture for SECA-Net; S130: Design a Selective Efficient Convolution (SE-Conv) module to reduce redundant convolution operations through selective channel computation mechanism; S140: Design an Adaptive Context Aggregation Block (ACFB) to aggregate contextual information from multi-level features; S150: Train the constructed intrusion detection classification model and provide the classification results.
2. The network intrusion detection method according to claim 1, characterized in that, In the data processing, the network traffic data is first cleaned and its features are extracted. Then, the Gramian Angular Field (GAF) method is used to map the one-dimensional traffic sequence into a two-dimensional matrix representation. The input sequence is then normalized using the following formula: ； Mapping to polar coordinate space Then construct the GAF matrix. ,in This process explicitly encodes temporal dependencies into spatial structure information, providing a suitable input format for subsequent visual feature modeling.
3. The network intrusion detection method according to claim 1, characterized in that, The SECA-Net network structure consists of five processing stages (Stages 1-5), lightweight feature encoding, global feature modeling, adaptive feature fusion, and a classification decision module. Its end-to-end mapping relationship is as follows: ;in This represents the overall feature transformation process through five processing stages. The final classification decision function; the core data flow of the model is: ； ； ； At the beginning of each stage, GhostModule is used for lightweight channel upscaling and spatial downsampling. In Stages 1-2, the model uses multi-layer SE-Conv for progressive feature extraction, gradually building a multi-level representation from low-level statistical features to mid-level behavioral patterns. Starting from Stage 3, the model introduces ACFB module to adaptively fuse multi-scale features, enhancing the modeling ability of global context.
4. The network intrusion detection method according to claim 1, characterized in that, In the SE-Conv module, the input features are first processed. ； Divide it into channels Groups: ； The first two groups each account for One channel, the last group occupies One channel; for each group SE-Conv further divides the channel into two equal parts, focusing only on the first half of the channel. Apply standard 3×3 convolution operation to the second half of the channels. Maintain the identity mapping to preserve the original feature information: ； The outputs of the three groups are concatenated to obtain: ； Subsequently, information exchange is performed through a Channel Shuffle operation, and lightweight spatial and channel blending is achieved through depthwise separable convolution (DWConvPW), as shown in the following formula: ; ； To further enhance the discriminative power of features, SE-Conv introduces a lightweight Squeeze-and-Excitation (SE) gating mechanism. This mechanism adaptively recalibrates the importance of each channel through global context modeling and generates channel-level weights using a two-layer small MLP and sigmoid activation. The features are weighted channel by channel, as shown in the following formula: ； Finally, SE-Conv normalizes features using BatchNorm and introduces a learnable residual scaling parameter λ∈(0,1) to perform residual fusion with the input features, achieving residual learning, as shown in the following formula: .
5. The network intrusion detection method according to claim 1, characterized in that, In the ACFB module, a Multi-Resolution Analyzer (MRA) and a Channel-wise Booster (CWB) are introduced during the feature fusion stage. This allows the network to adaptively adjust the importance of features at different spatial scales and in different channels based on the statistical properties of the input features. First, the feature is divided into two branches through a linear mapping for different feature processing purposes, as shown in the following formula: .
6. The network intrusion detection method according to claim 5, characterized in that, In the aforementioned MRA and CWB, MRA is for Spatial downsampling (factor 8) is performed to obtain coarse-grained feature statistics, and these are then processed through learnable parameters. and The multi-scale weights are adaptively adjusted, then upsampled back to the original resolution, and gated modulation is performed using SiLU activation and linear mapping, as shown in the following formula: ; ； in Perform 8x spatial downsampling. For channel-independent convolution, For along spatial dimensions Calculate the characteristic variance; CWB uses a DMlp (Depthly Convolutional Multilayer Perceptron) to process the y-branch. This module performs a fully connected transformation in the channel dimension and a lightweight convolution operation along the spatial dimension, as shown in the following formula: Finally, the feature fusion process adds the outputs of the two branches, fusing the spatially adaptive global semantics. ) and local details ( ): 。 7. The network intrusion detection method according to claim 1, characterized in that, In the training of the classification model, the cross-entropy loss function is used for end-to-end training, and the optimization objective is: ; in The number of training samples. For the first The true class labels (one-hot encoded) of each sample. For the model to the first The first sample Predicted probability of class These are all the learnable parameters of the model.