A Hybrid Deep Learning Architecture for Intrusion Detection Deploying Multi-Scale Feature Interaction and Temporal Modeling

Abstract

Network intrusion detection is a core component of modern cybersecurity, but it remains challenging due to highly imbalanced traffic, heterogeneous feature types, and a presence of short-term temporal dependencies in network flows. Traditional machine learning models often rely on handcrafted features and struggle with complex attack patterns, while deep learning approaches may become overly complex or difficult to interpret. In this paper, we propose a neural intrusion detection method that combines structured feature preprocessing with a compact hybrid architecture. Numerical and categorical traffic features are processed separately using robust normalisation and trainable embeddings, and then merged into an unified representation. The proposed model builds on a multi-scale feature interaction block, followed by channel-wise attention and a single bidirectional gated recurrent unit layer with attention pooling to capture short-term temporal behavior. The method is evaluated on two widely used benchmark datasets, i.e., the CIC-IDS2017 and CSE-CIC-IDS2018 dataset. Experimental results show that the proposed approach consistently outperforms the classical machine learning baselines and achieves competitive or superior performance compared to the recent deep learning methods proposed in the literature. The results confirm that the proposed architectural choices effectively capture both feature interactions and temporal patterns in network traffic.

1. Introduction

Modern computer networks form the backbone of almost all digital services, ranging from enterprise systems and cloud platforms to industrial control systems and IoT environments [1]. At the same time, these networks are continuously exposed to a wide spectrum of cyber threats, including denial-of-service (DoS) attacks, brute-force attempts, botnets, web-based exploits, and increasingly sophisticated multi-stage intrusions [2,3]. As network infrastructures grow in size and complexity, manual monitoring and traditional rule-based or signature-based intrusion detection systems become insufficient to cope with volume, diversity, and dynamics of modern network traffic [4].

This limitation has driven a strong shift towards machine learning and deep learning techniques for intrusion detection. Numerous studies report that machine learning models can achieve very high detection accuracy on widely used benchmark datasets [2,5,6,7,8,9,10,11]. Moreover, the recent research has increasingly focused on deep learning and hybrid architectures that combine different neural components. Convolutional Neural Networks (CNNs) are commonly used to learn feature representations, while recurrent models such as Long Short-Term Memory (LSTM) or Gated Recurrent Unit (GRU) are employed to capture temporal behavior in network traffic [12,13,14]. These hybrid models often outperform classical machine learning approaches, especially on complex and multi-attack datasets. Anyhow, there is still room to increase a performance of intrusion detection systems while keeping their computational complexity at reasonable level, allowing a near real-time deployment.

Motivated by a research gap identified in Section 2.6, this work focuses on improving intrusion detection performance through architectural design rather than relying solely on deeper networks or extensive data augmentation. Our goal is to design a hybrid deep learning model that can capture complex feature interactions and short-term temporal dependencies in network traffic, and to evaluate its performance against existing state-of-the-art intrusion detection models.

We propose a hybrid intrusion detection model that operates directly on tabular flow-based features and combines multi-scale one-dimensional convolutions, channel-wise attention, and bidirectional recurrent modelling. The model is designed to better handle heterogeneous traffic features and to improve detection performance for minority attack classes. Its effectiveness is evaluated through a detailed comparison with the state-of-the-art deep and hybrid intrusion detection approaches.

The main contributions of this work are summarized as follows:

• We propose a hybrid intrusion detection architecture that combines multi-scale convolutional feature interaction learning, channel-wise attention, and bidirectional temporal modeling, specifically designed for flow-based network traffic data.
• We show that adaptive feature recalibration and temporal attention improve detection performance, particularly for minority and rare attack classes, without relying solely on heavy data augmentation techniques.
• We provide a comprehensive experimental evaluation on modern benchmark datasets, demonstrating that the proposed approach achieves competitive or superior performance compared to the existing state-of-the-art intrusion detection models.

The remainder of this paper is organized as follows. Section 2 reviews related work in intrusion detection. Section 3 describes datasets, baseline machine learning methods, and the proposed model. Section 4 details experimental setup and evaluation metrics. Section 5 presents experimental results, including a benchmark comparison and an ablation study. Section 6 discusses the findings, and Section 7 concludes this paper.

2. Related Works

Research on intrusion detection has moved from traditional machine learning to increasingly complex deep learning and hybrid models. Early surveys show that machine learning and deep learning methods are now common in intrusion detection systems, but also point out open problems such as class imbalance, high computational cost and the difficulty of detecting new attacks [9,15,16]. The recent studies [13,14,17,18,19] focus on improving accuracy, reducing false alarms and handling real network traffic with many attack types and large feature spaces.

2.1. Classical Machine Learning Approaches

Several works use classical machine learning models as a baseline for intrusion detection. Maseer et al. [7] compared ten algorithms, including Artificial Neural Networks (ANNs), Decision Trees (DTs), k-nearest neighbours (kNNs), Naive Bayes (NB), Random Forests (RFs), and support vector machines (SVMs) on a modern multi attack dataset. They evaluated both accuracy and computational efficiency and found that the kNN, DT and NB provide a good trade-off between the performance and cost, while the Neural Network (NN)-based models achieved similar accuracy but with much higher training and testing times. Verma and Ranga [11] also carried out a wide comparison on a flow-based dataset, testing supervised and unsupervised models such as ANN, kNN, and SVM. They reported that the kNN, SVM, DT, RF, and deep learning achieved accuracy above 99.9% on the corresponding dataset. Kilincer et al. [9] extended this line of work with a comparative study of SVM, kNN, and decision trees on several widely used benchmark datasets, including CSE-CIC-IDS2018, UNSW NB15, ISCX 2012, NSL KDD, and CIDDS. They showed that the DT consistently gave the best accuracy on most datasets, except for the UNSW NB15, where the performance dropped for all the models.

Other works investigate ensemble and feature selection techniques to improve classical models. Kaja et al. [20] proposed a two stage intrusion detection system that uses K-means clustering in the first stage and DT, RF and NB in the second stage, achieving accuracy between 92.74% and 99.97% on KDD99. Lian et al. [21] combined recursive feature elimination with DT and reported accuracy of 99.23% on benchmark datasets. Injadat et al. [22] designed a multi stage machine learning framework that applies SMOTE resampling, feature selection and metaheuristic parameter optimisation. They demonstrated that this pipeline improves detection accuracy while reducing the number of training samples and features compared with simpler baselines.

2.2. Deep Learning and Hybrid Models

Deep learning has been widely applied to intrusion detection in recent years. Ferrag et al. [16] surveyed more than forty deep learning based intrusion detection systems and implemented seven deep models alongside NB, ANN, SVM, and RF. Using datasets such as the CSE-CIC-IDS2018 and Bot IoT, they reported that the Deep Neural Network (DNN) models achieved a detection rate around 95%, outperforming the 90% detection rate of the traditional methods.

Several studies designed task specific deep or hybrid architectures. Vinayakumar et al. [12] proposed a five layer DNN that can be applied to either host-based or network-based intrusion detection and evaluated it on several public datasets. With tuned hyperparameters and ReLU and softmax activations, their model achieved a high accuracy and low false alarm rate (FAR), outperforming the SVM, RF, and NB on complex and recent network traffic. They also introduced the SHIA framework to process large scale traffic in near real time. Hassan et al. [13] presented a hybrid deep learning model combining CNNs with a weight dropped LSTM network and showed improved detection performance in big data environments. Altunay and Albayrak [14] proposed a CNN plus LSTM architecture for industrial IoT networks and reported that the hybrid model achieved better results than the single deep models on industrial traffic. Khan [23] introduced HCRNNIDS, a hybrid convolutional recurrent neural network (RNN) intrusion detection system. Evaluated on the CSE-CIC-IDS2018 dataset, the HCRNNIDS achieved a high detection rate for malicious attacks, outperforming traditional ML classifiers and other deep learning models (DBN, DNN, LSTM, CNN), confirming the benefit of combining convolutional and recurrent layers for time dependent traffic.

Other works mix deep learning with classical classifiers. Lee et al. [17] combined a deep sparse autoencoder for feature extraction with a RF classifier. Their DSAE RF model, evaluated on a multi attack dataset, reached 99.83% accuracy, 97.8% precision, 88.17% recall and 90.30% F1 score. Compared with the plain RF, they reduced training time from 781 s to 330 s and testing time from 21 s to 13 s, while keeping high performance. The authors also showed that recall for very rare attacks such as infiltration was only 13.3%, highlighting the impact of class imbalance.

2.3. Handling Imbalanced and Rare Attack Classes

Class imbalance is one of the main challenges in intrusion detection. Many modern datasets are dominated by benign traffic, while some attack types have only a few samples. Several authors explicitly address this issue using resampling and generative methods. Zhang and Liu [24] proposed an ICVAE BSM method for intrusion detection in IoT settings with strongly imbalanced data. They combined an improved conditional variational autoencoder with Borderline SMOTE. An auxiliary network helped separate classes in the latent space and reduce the KL vanishing problem, and the BSM was used to interpolate between borderline samples of minority classes. Tested on the NSL KDD, CIC-IDS2017 and CSE-CIC-IDS2018 datasets, their approach significantly improved detection of rare attack types. Louk and Tama [25] compared several ensemble based imbalance learners and concluded that the EasyEnsemble performed better than other sampling strategies for industrial control network traffic. Liu et al. [5] split traffic into hard and easy sets using Edited Nearest Neighbours and then applied K-means clustering within the hard set. This reduced imbalance and improved detection performance for mixed machine learning and deep learning pipelines.

The SMOTE based augmentation is also used together with deep learning. Mohammad et al. [19] showed that SMOTE augmentation applied to minority classes improved F1 scores for rare web attacks such as SQL injection, cross-site scripting, and Heartbleed for their CNN and LSTM model. Mbow et al. [26] and Zhang et al. [18] also reported that the deep models trained on resampled data achieved higher detection rates on minority classes than the models trained on imbalanced data. More specifically, Zhang et al. [18] combined SMOTE oversampling for minority classes with a Gaussian mixture model (GMM) clustering undersampling for majority classes, achieving better balance without excessive time or data loss. Zhang et al. [27] proposed a parallel cross CNN for multi class imbalanced network traffic, showing that architecture design and feature fusion can reduce a negative impact of imbalance. Panigrahi et al. [28] addressed an imbalance in host based intrusion detection by using an improved random sampling and feature selection mechanism before a consolidated decision tree classifier, achieving very high detection accuracy on multiclass imbalanced datasets.

2.4. IoT and IIoT Oriented Intrusion Detection

A growing part of the literature focuses on intrusion detection for IoT and industrial IoT (IIoT) environments, where devices are resource constrained and traffic patterns differ from traditional networks. Altunay and Albayrak [14] designed a hybrid CNN and LSTM intrusion detection system for IIoT networks and showed high detection performance on industrial traffic for both binary and multi-class classification. Nandanwar and Katarya [29] also proposed a deep learning based intrusion detection system for IIoT and demonstrated that deep models can reach high accuracy on specialised IIoT datasets.

Other authors worked with IoT specific datasets. Javeed et al. [30] developed a hybrid framework for secure industries by combining deep learning with software defined networking. Using the N-BaIoT dataset, the Cu-LSTMGRU + Cu-BLSTM model achieved 99.45% accuracy, 99.34% precision, 98.49% recall and 99.47% F1 score. Alharbi et al. [31] proposed a Local-Global Bat Algorithm to optimise a NN for botnet detection in industrial IoT, reporting improved multi class botnet detection accuracy of up to 90% on N-BaIoT compared with the particle swarm optimisation and standard bat algorithms. Baig et al. [32] focused on DoS attacks in IoT networks and used averaged dependence estimators on both a custom MQTT based testbed and the Bot-IoT dataset, showing that their classifier could detect DoS attacks with high accuracy.

Blockchain and trust mechanisms have also been integrated with intrusion detection in IoT. Nguyen et al. [33] combined a blockchain based data transfer with deep belief networks and ResNet for secure cyber physical systems in healthcare. Their model, evaluated on the NSL-KDD and CIDDS datasets, achieved better results than baseline methods while ensuring privacy. Ali et al. [34] proposed a blockchain based trust mechanism using fuzzy logic to mitigate Sybil attacks in the internet of medical things, highlighting how trust management can complement intrusion detection in specialised IoT domains. Hassan et al. [35] designed a reliable cyberattack detection model to increase trustworthiness in industrial IoT networks, again showing that accurate detection supports higher level trust frameworks.

2.5. Ensemble, Anomaly Based and Semi Supervised Methods

Beyond standard supervised classification, several works explore ensemble, anomaly based and semi supervised approaches. Gao et al. [36] proposed an adaptive ensemble machine learning model that combines RF, DT and DNNs through a voting scheme. They reported high accuracy and improved robustness compared with single classifiers. Yousefnezhad et al. [37] used feature extraction based on deep learning together with ensemble classification and showed that their stacked models achieved better performance than individual learners. Zhang et al. [38] developed a multi dimensional feature fusion and stacking ensemble mechanism, demonstrating that feature fusion and ensemble learning can significantly increase detection rates on structured traffic. Kaur and co authors [39] and Kabir et al. [40] also demonstrated the benefit of stacking and voting based ensembles on datasets such as NSL-KDD, UNSW-NB15 and CIC-IDS2017.

Anomaly based and unsupervised methods are proposed to detect unknown attacks. Hindy et al. [41] used deep learning to detect zero day attacks by training on normal traffic only and evaluating on attack traffic coming from the CIC-IDS2017 and NSL-KDD datasets. Their model and a one class SVM achieved low miss rates on unseen attacks. Pu et al. [42] combined subspace clustering and one class SVM for unsupervised anomaly detection and achieved strong performance on the NSL-KDD dataset. Liao et al. [43] introduced ENAD, an ensemble framework of autoencoders and generative adversarial networks (GAN). They combined traditional, variational and convolutional autoencoders with a GAN and aggregated reconstruction based anomaly scores. Experiments showed that the ensemble outperformed individual models, although at higher computational cost. Shieh et al. [44] and Chartuni and Márquez [45] focused on detection of unknown distributed DoS attacks with deep learning and GMM or multi classifier NNs.

Semi supervised learning has been explored to reduce the need for labelled data. Ravi and Shalinie [46] proposed a semi supervised security framework that uses both labelled and unlabelled samples and combines feature selection with an extreme gradient boosting ensemble. Tested on the UNSW-NB15, NSL-KDD and CIC-IDS2017 datasets, their method achieved high accuracy with a low computational complexity. Li et al. [47] introduced DAS-CIDS, a disagreement based semi supervised collaborative intrusion detection system for IoT. By exploiting unlabeled data through a disagreement based algorithm, they reduced false alarms and improved detection compared with the purely supervised classifiers in both the simulated and real IoT environments.

2.6. Identified Research Gap

The detailed review of the classical machine learning approaches, i.e., [2,5,6,7,8,9,10,11], has revealed some persistent challenges. Contemporary intrusion detection datasets are typically highly imbalanced, with benign traffic dominating the data and many attack categories represented by only a small number of samples. In addition, network flows are described by a large set of heterogeneous features, including statistical measures, temporal attributes, and protocol-level information. As a result, models that achieve excellent overall accuracy may still struggle to reliably detect rare but security-critical attacks.

When it comes to the hybrid models, which naturally outperform the classical machine learning approaches, they often rely on deep architectures, complex pipelines, or extensive data augmentation to handle class imbalance and rare attacks [18,19,24]. The above-listed approaches rapidly increase their computational complexity, so their near real-time deployment is rather questionable.

An important final observation from the existing work is that high overall accuracy does not necessarily mean reliable intrusion detection in practice. Several studies report very low recall for minority attack classes, even when the reported accuracy exceeds 99% [17]. This indicates that detecting rare and diverse attack patterns remains an open challenge. While resampling techniques such as SMOTE can improve minority class performance, they may also introduce synthetic noise and make the learning process more complex [22,26].

3. Materials and Methods

3.1. Datasets

The experiments are conducted using two widely adopted benchmark datasets for network intrusion detection, i.e., the CIC-IDS2017 and CSE-CIC-IDS2018 [48]. Both datasets were released by the Canadian Institute for Cybersecurity and were generated in the controlled testbed environments that emulate realistic enterprise networks, combining benign user activity with a wide range of malicious behaviors.

The CIC-IDS2017 dataset was collected over five consecutive days in July 2017. It contains network traffic generated by common user activities such as web browsing, email communication, file transfer, and VoIP, mixed with scheduled attack scenarios. The dataset includes 2,830,723 network flows described by 79 traffic features and labeled into 14 classes. As summarized in Table 1, a benign traffic dominates the dataset accounting for more than 80% of all the samples, while several attack types appear only rarely. This strong class imbalance is clearly illustrated in Figure 1, where a small number of the classes occupy most of the data distribution.

Table 1. Summary of the datasets used in this study.

Dataset Property	CIC-IDS2017	CSE-CIC-IDS2018
Number of records	2,830,723	16,233,022
Number of features	79	78
Number of benign samples	2,359,269	13,473,658
Number of attack samples	471,454	2,759,364
Number of classes	14	14

Figure 1. Distribution of output classes in the CIC-IDS2017 dataset.

The CSE-CIC-IDS2018 dataset applies the same data collection methodology to a much larger and more complex network environment. It contains traffic from multiple departments and a broader range of user behaviors, resulting in more diverse attack patterns. The dataset consists of 16,233,022 network flows described by 78 features and labeled into 14 classes. In addition to the attacks covered by the CIC-IDS2017 dataset, it includes several application-layer attacks such as SQL injection and brute-force attacks against FTP and SSH services. Similar to the 2017 dataset, the benign traffic represents the majority of the samples. The imbalance between the benign and malicious classes, as well as among different attack categories, is shown in Figure 2.

Figure 2. Distribution of the output classes in the CSE-CIC-IDS2018 dataset.

As both datasets reflect realistic traffic patterns and exhibit severe class imbalance, they are well suited for evaluating intrusion detection systems under practical conditions. Their scale, detailed labeling, and inclusion of modern attack scenarios allow a meaningful assessment of both overall detection performance and robustness to minority attack classes.

3.2. Machine Learning Algorithms

This subsection gives a short introduction to the machine learning algorithms used for attack detection in network traffic. These methods were selected as baseline approaches for a comparison with our proposed network, and their main principles are briefly explained in the following subsections.

3.2.1. Decision Tree

DT [49] classifies traffic by applying a sequence of simple decisions based on feature values. At each step, the data are split using a condition that best separates traffic types. This process continues until a final decision is reached. The resulting structure represents traffic behavior as a set of clear and interpretable decision rules.

3.2.2. Random Forest

RF [50] is a supervised method that builds many decision trees from different parts of the training data. Each tree learns its own set of decision rules to separate normal and attack traffic. During prediction, outputs of all the trees are combined to obtain a final decision. This approach allows a model to capture different patterns in network traffic by aggregating multiple independent views of data.

3.2.3. K-Means

K-means [51] is an unsupervised method that groups traffic samples based on their similarity in the feature space. The algorithm assigns samples to clusters and updates cluster centers iteratively. In intrusion detection, clusters usually represent common traffic behavior, while samples that do not fit well into these clusters can indicate abnormal or suspicious activity. For evaluation purposes, each cluster was mapped to a class label using a majority voting on the training data. The assigned cluster labels were then used to compute the standard classification metrics. This allows a comparison with the supervised methods, although such comparison should be interpreted carefully because K-means does not use a label information during the training.

3.2.4. K-Nearest Neighbours

kNN [52] is a method that makes decisions based on similarity to previously seen samples. Instead of learning a model, it stores the training data and compares new traffic samples to it. The class is assigned according to the most common label among the closest samples. This method relies on local similarity in the feature space to identify traffic behavior.

3.2.5. Support Vector Machine

SVM [53] separates traffic classes by finding a boundary that best divides normal and attack samples. The boundary is defined by a small number of critical samples that lie close to it. By using kernel functions, the method can model complex patterns and separate traffic that is not linearly distinguishable in the original feature space.

3.2.6. XGBoost

XGBoost [54] is an ensemble learning method based on gradient boosting of decision trees. It builds a sequence of trees, where each new tree focuses on correcting errors of the previous ones. By combining many simple trees, XGBoost is able to model complex feature interactions and achieve strong classification performance on structured traffic data.

3.2.7. 1D CNN

1D CNN [55] is a CNN designed to process sequential or tabular data. It applies convolution filters to learn local feature patterns from network traffic statistics. Typically, it consists of a small number of convolution layers followed by pooling and fully connected layers. This simple architecture allows efficient feature extraction while keeping computational complexity relatively low.

3.3. Proposed Method

This section describes the proposed intrusion detection method and explains the design choices behind each of its components. The method is designed to address three practical issues commonly encountered in network intrusion detection: heterogeneous feature representations, variability in feature interaction patterns across attack types, and the presence of short-term temporal dependencies in network traffic.

The proposed pipeline consists of two main parts. First, raw network traffic data are converted into a unified feature representation through structured preprocessing. Second, this representation is processed by a compact neural architecture that combines multi-scale feature interaction learning, adaptive feature recalibration, and lightweight temporal modelling.

3.3.1. Input Representation and Preprocessing

Network traffic data are naturally described as tabular records, where each row represents a network flow and each column corresponds to a statistical or protocol-level feature. In the proposed method, this tabular structure is intentionally preserved, because each feature has a clear semantic meaning that is important for intrusion detection.

As shown in Figure 3, raw traffic records are first cleaned by removing missing values, duplicate entries, and invalid fields. This step ensures that the model is trained only on consistent and reliable data. After the cleaning, the remaining features are separated into numerical and categorical types. This separation is necessary because the two feature groups differ significantly in scale, distribution, and semantic interpretation.

Figure 3. Input representation and preprocessing pipeline. Raw network traffic data are cleaned and separated into numerical and categorical features. Numerical features are processed using robust normalisation, while categorical features are mapped to trainable embedding vectors. The resulting features are concatenated into a unified feature vector that serves as an input to the proposed model.

To improve a reproducibility of the proposed approach, the preprocessing procedure follows commonly reported practices deployed for the CIC intrusion detection datasets [5,7,48]. The original CIC-IDS2017 dataset contains approximately 2.83 million flow records with 79 features, while the CSE-CIC-IDS2018 dataset contains about 16.2 million flow records with 78 features, as summarized in Table 1. During the data cleaning, rows containing missing values (NaN), infinite values caused by feature divisions, duplicate entries, and clearly invalid flow records were removed. After this step, the CIC-IDS2017 dataset was reduced to 2.80 million valid records and the CSE-CIC-IDS2018 dataset to 15.9 million records. These reductions are consistent with the previously reported preprocessing practices for these datasets.

Numerical features such as packet counts, byte volumes, and flow durations often exhibit extreme values and heavy-tailed distributions. If used directly, these values can dominate the learning process and make training unstable. To mitigate this issue, robust normalisation calculated according to (1) is applied to each numerical feature:

$$x^{\prime }={\displaystyle \frac{x-\mathrm{median}\left(x\right)}{\mathrm{IQR}\left(x\right)}},$$

(1)

where $\mathrm{median}\left(x\right)$ is a median value and $\mathrm{IQR}\left(x\right)$ is an interquartile range of the feature. This scaling strategy reduces sensitivity to outliers while preserving the relative differences between samples.

Categorical features, such as protocol type or service identifier, are processed separately. Each category is first mapped to an index and then transformed into a dense, trainable embedding vector. These embeddings are learned jointly with the rest of the model and allow the network to capture semantic similarities between categories without introducing artificial ordering.

In this study, categorical attributes correspond mainly to protocol-related identifiers typically treated as non-ordinal variables in the intrusion detection literature, including protocol type, service identifiers, and selected flow direction indicators when available. Each categorical feature is encoded using trainable embeddings with dimension of 4, which provides a compact representation while preserving categorical semantics. Categories not observed during training are mapped to a dedicated “unknown” token to ensure stable inference and prevent information leakage. After the normalisation and embedding, numerical features and categorical embeddings are concatenated into a single unified feature vector.

The resulting unified feature vector contains 84 input dimensions after the concatenation. This vector representing one network flow serves as an input representation for the proposed neural network architecture and is used consistently across both evaluated datasets.

3.3.2. Proposed Model Architecture

The proposed neural architecture is designed to extract discriminative patterns from the unified feature vector while keeping the model compact and efficient. The overall structure of the model is shown in Figure 4. The architecture is composed of four main blocks, namely a feature projection, multi-scale feature interaction learning, channel-wise feature recalibration, and temporal modelling.

Figure 4. Architecture of the proposed intrusion detection model. The unified feature vector is projected into a latent space and processed by a multi-scale 1D convolutional block with kernel sizes of $k\in \{1,3,5\}$. Channel-wise recalibration is performed using SE attention. Short-term temporal dependencies are modelled using a single BiGRU layer followed by an attention-based temporal pooling.

The unified feature vector is first passed through a feature projection layer implemented as a fully connected transformation followed by a nonlinear activation. This layer aligns heterogeneous input features into a latent space of fixed width and provides a stable representation for a subsequent processing. Its purpose is not a classification, but preparing the features for an interaction learning.

The core part of our proposed model is the multi-scale one-dimensional convolutional block. Instead of using a single convolutional layer, we introduce three parallel convolutional branches with kernel sizes of $k\in \{1,3,5\}$. This design choice reflects the fact that intrusion patterns do not appear at a single scale. Some attacks are characterized by local relationships between a small number of traffic features, while others depend on broader correlations across multiple statistics.

Each branch processes the same projected representation and learns feature interactions at a different range. The outputs of all branches are concatenated, which allows the model to combine information from multiple interaction scales in a single representation. To reduce a computational complexity, all the convolutional branches use depthwise separable convolutions. This significantly lowers a number of parameters and operations compared to the standard convolutions, while remaining expressive enough for feature interaction learning.

A residual connection is added between the projected input and the output of the multi-scale block. This design helps to preserve low-level feature information and stabilizes training, allowing the convolutional block to focus on learning additional interactions rather than replacing the original representation.

After multi-scale feature extraction, a channel-wise feature recalibration is applied using squeeze-and-excitation (SE) attention. This is one of the key components of our proposal. SE attention allows the model to explicitly learn which feature channels are more important for intrusion detection. Channels that carry strong attack-related signals are emphasized, while less informative or redundant channels are suppressed. This mechanism is particularly well suited to tabular data, where channels correspond to learned feature interactions rather than spatial locations.

To capture short-term temporal dependencies, the recalibrated feature representations are grouped into short windows and processed by a single bidirectional GRU (BiGRU) layer. The bidirectional structure enables the model to use both past and future context within each window, which is useful when attack-related behavior does not occur at fixed temporal positions. We deliberately use only one GRU layer to balance temporal modelling capability and computational efficiency.

Within each temporal window, attack-related evidence may appear only at a few time steps. To avoid treating all time steps equally, we apply attention-based temporal pooling. This mechanism assigns a higher importance to time steps that contribute most strongly to a final decision and aggregates the sequence into a single window-level representation.

Temporal windows are created from flows ordered by timestamp. Each window contains 10 consecutive flows with 50% overlap (stride = 5). This sliding-window setup is commonly used in flow-based intrusion detection and helps to capture short-term traffic behavior. Flows are ordered only by time. No grouping by host, session, or five-tuple is applied to keep the method general.

To avoid data leakage, the dataset is first split into training and testing sets by applying 80:20 ratio. Part of the training data is further used as a validation set. Temporal windows are then created separately inside each subset, so no window crosses the subset boundaries. Training is performed offline using a mini batch processing. However, since the model operates on short sequences of flows, it is believed that it can also be applied in a near real time deployment where flows arrive sequentially and windows are updated continuously.

For clarity and reproducibility reasons, a compact architectural summary of the proposed model is provided in Table 2. The table reports the main processing blocks, layer configurations, output dimensions, and parameter counts. The architecture was intentionally designed to remain lightweight so that it can be deployed in a near real-time intrusion detection scenarios without requiring extensive computational resources.

Table 2. Compact architecture summary of the proposed model for an input window of length $T=10$ and unified feature dimension $D=84$. The model outputs 14 classes.

Block	Layer Details	Output Shape	#Params
Input	Unified feature vector (numerical + embeddings)	$(B,T,84)$	0
Feature projection	Linear $84\to 64$ + ReLU + Dropout ($p=0.1$)	$(B,T,64)$	5440
Multi-scale DSConv1D	DSConv1D, $k=1$ (DWConv + PWConv + BN + ReLU)	$(B,64,T)$	4288
	DSConv1D, $k=3$ (DWConv + PWConv + BN + ReLU)	$(B,64,T)$	4416
	DSConv1D, $k=5$ (DWConv + PWConv + BN + ReLU)	$(B,64,T)$	4544
Concatenation	Concatenate channels from $k\in \{1,3,5\}$ branches	$(B,T,192)$	0
Residual block	Skip projection $64\to 192$ + fuse Linear $192\to 192$ + LN + Dropout	$(B,T,192)$	49,920
SE channel attention	FC $192\to 24\to 192$ (sigmoid gate)	$(B,T,192)$	9432
Temporal modelling	1-layer BiGRU ($192\to 64$ per direction)	$(B,T,128)$	99,072
Temporal attention pooling	Linear scoring $128\to 1$ + weighted sum over time	$(B,128)$	129
Classifier	Linear $128\to 14$ (softmax applied externally)	$(B,14)$	1806
Total			178,855

3.3.3. Training Objective and Optimization Strategy

Network intrusion detection datasets are typically highly imbalanced [5,7,17,24], with benign traffic representing the majority of the samples and many attack types occurring only rarely. If a model is trained using a standard cross-entropy objective, it often becomes biased toward the dominant benign class and achieves high accuracy while missing a significant portion of attacks.

To mitigate this issue, we adopt a training objective that explicitly takes class imbalance into account. The model is trained using a weighted classification loss, where higher importance is assigned to underrepresented attack classes. This encourages the network to focus on difficult and rare samples during training and reduces the tendency to favor majority classes.

Let y denote the true class label and $\widehat{y}$ the predicted class probabilities. The training objective is defined as a weighted cross-entropy loss and calculated as in (2):

$$\mathcal{L}=-\sum _c{w}_c{y}_{c}log\left({\widehat{y}}_c\right),$$

(2)

where $w_c$ is a weight associated with class c. Class weights are computed based on the inverse frequency of each class in the training data, ensuring that rare attack types contribute more strongly to the overall loss.

The model is optimized using mini-batch gradient descent. A moderate batch size is used to balance stable gradient estimation and efficient GPU utilization. To prevent overfitting and improve generalization, dropout is applied to selected layers during training. Early stopping based on validation performance is used to avoid unnecessary training once convergence is reached.

This training strategy aligns the optimization process with the practical objective of intrusion detection, where correctly identifying attacks, especially rare ones, are more important than maximizing overall accuracy.

4. Performance Evaluation

This section evaluates the performance of the proposed intrusion detection method by describing the experimental setup and the metrics used to assess detection effectiveness on imbalanced network traffic data.

4.1. Simulation Setup

All the experiments were conducted on a high-performance workstation suitable for deep learning tasks. The system was equipped with an Intel(R) Xeon(R) Platinum 8352Y CPU running at 2.20 GHz (Intel Corporation, Santa Clara, CA, USA) and an NVIDIA GeForce RTX 3090 Ti GPU with 24 GB of dedicated memory (NVIDIA Corporation, Santa Clara, CA, USA). The workstation included 64 GB of system RAM and was operated under the Windows 11 operating system. All the model training and evaluation were implemented using the TensorFlow version 2.10.1.

Model training was performed using mini-batch learning with a batch size of 128. Each experiment was run for 100 epochs, which was sufficient to achieve stable convergence across all the tested configurations. Stochastic Gradient Descent (SGD) was used as the optimizer, with a fixed learning rate of 0.001. This choice provided stable training behavior and consistent performance across the datasets. To reduce overfitting and improve generalization, dropout with a rate of 0.5 was applied to the fully connected and recurrent components of the network.

The proposed architecture includes a single BiGRU layer for a temporal modelling, as described in the previous section. To study the effect of temporal model capacity, we vary a hidden state dimensionality of this single BiGRU layer. Specifically, a hidden size is set to 64, 128, or 256 units, depending on the experiment. This allows us to analyze the trade-off between temporal representation capacity and computational complexity while keeping the overall architecture unchanged.

4.2. Performance Evaluation Metrics

The performance of a classification model is evaluated using the standard metrics derived from the confusion matrix. The confusion matrix describes how predicted labels compare to true labels and is defined by four basic outcomes. True positives (TP) are attack samples that are correctly classified as attacks. True negatives (TN) are normal samples that are correctly classified as benign. False positives (FP) correspond to normal traffic that is incorrectly flagged as an attack, while false negatives (FN) represent attacks that the model fails to detect.

Accuracy measures how many samples are correctly classified overall. It is computed according to (3) as a ratio of correct predictions to a total number of predictions:

$$\mathrm{Accuracy}={\displaystyle \frac{TP+TN}{TP+TN+FP+FN}}$$

(3)

Accuracy gives a general idea of performance, but it can be misleading when the data contain a large imbalance between normal traffic and attacks.

Precision describes how reliable the attack predictions are. It measures a proportion of correctly detected attacks among all samples labeled as attacks by the model and is calculated as in (4):

$$\mathrm{Precision}={\displaystyle \frac{TP}{TP+FP}}$$

(4)

High precision means that the model raises fewer false alarms, which is important in practical security monitoring.

Recall measures how well the model detects actual attacks. It is defined as a ratio of correctly detected attacks to all real attacks and is computed as in (5):

$$\mathrm{Recall}={\displaystyle \frac{TP}{TP+FN}}$$

(5)

A high recall value indicates that most malicious activities are captured by the system.

The F1 score combines the precision and recall into a single value using their harmonic mean and is calculated according to (6):

$$\mathrm{F}1\mathrm{score}=2·{\displaystyle \frac{\mathrm{Precision}·\mathrm{Recall}}{\mathrm{Precision}+\mathrm{Recall}}}$$

(6)

The F1 score is useful when dealing with imbalanced data because it balances missed attacks and false alarms.

Together, the TP and TN describe correct model decisions, while the accuracy, precision, recall, and F1 score provide a clear and compact way to evaluate and compare intrusion detection models.

5. Experimental Results

This section is divided into two parts. The first part presents a benchmark study in which the proposed intrusion detection method is compared with the classical machine learning approaches and representative deep learning models. The second part reports an ablation study designed to quantify a contribution of the individual architectural components to a final performance.

5.1. Benchmark Study

The benchmark study evaluates the proposed method on the CIC-IDS2017 and CSE-CIC-IDS2018 datasets and compares its performance against widely deployed baseline classifiers, including K-means, SVM, kNN, DT, RF, XGBoost and 1D CNN. K-means is included in this study mainly as an unsupervised reference point, not as a fully competitive baseline. Since it does not use class labels during a training, its results are not directly comparable with the supervised classifiers but anyhow provide a useful indication of how purely similarity-based clustering performs on the intrusion detection data.

The results obtained on the CIC-IDS2017 dataset are summarized in Table 3. Here, Time (s) denotes the total time required for model training and evaluation on the given dataset and serves as an indicator of the overall computational cost of each method. All the reported execution times correspond to the combined training and evaluation phase measured under the same hardware conditions for all the methods. The unsupervised clustering with K-means achieves the lowest accuracy and F1-score, reflecting its limited ability to handle highly imbalanced and complex traffic patterns, while exhibiting a moderate execution time. The SVM improves classification accuracy but remains below 97%, and its execution time increases due to kernel-based optimization. The kNN classifier achieves a higher recall, indicating improved detection of attack traffic; however, this comes at the cost of increased execution time caused by instance-based distance computations.

Table 3. Performance comparison of the baseline methods and proposed model on the CIC-IDS2017 dataset.

Method	Accuracy (%)	Precision (%)	Recall (%)	F1-Score (%)	Time (s)
K-means	95.03	96.40	95.21	95.80	276.4
SVM	96.84	96.12	97.01	96.56	412.1
kNN	97.56	96.63	98.57	97.59	314.2
1D CNN	99.12	98.05	98.18	98.10	210.3
DT	99.32	99.29	99.35	99.32	60.2
RF	99.38	98.45	99.83	99.13	489.2
XGBoost	99.41	99.36	99.44	99.40	521.5
Proposed Method	99.56	99.52	99.54	99.53	244.6

The tree-based classifiers show a clear improvement in both accuracy and efficiency. The Decision Tree exceeds 99% accuracy while requiring the lowest execution time among all evaluated methods, making it computationally attractive. The Random Forest improves recall by aggregating multiple trees but incurs a substantially higher execution time due to ensemble training. XGBoost provides the strongest performance among classical methods, achieving 99.41% accuracy with a balanced precision–recall trade-off, though its execution time remains relatively high as a result of iterative boosting and tree construction. The 1D CNN baseline achieves 99.12% accuracy on the CIC-IDS2017 dataset, remaining below the proposed model.

The proposed method outperforms all baseline approaches on the CIC-IDS2017 dataset, achieving an accuracy of 99.56% together with the highest precision, recall, and F1-score. Importantly, this performance is achieved with a lower execution time than kNN, Random Forest, and XGBoost, indicating that the proposed architecture captures complex feature interactions efficiently without relying on computationally heavy ensemble mechanisms.

Table 4 reports the results obtained on the more challenging CSE-CIC-IDS2018 dataset. Due to the larger scale, higher traffic diversity, and more complex attack scenarios, all the methods experience increased execution times compared to CIC-IDS2017. K-means and SVM again show limited effectiveness, while kNN incurs the highest computational cost. The Decision Tree remains the fastest method but suffers the from reduced accuracy. 1D CNN, Random Forest and XGBoost achieve stronger classification performance at the expense of higher execution time.

Table 4. Performance comparison of the baseline methods and proposed model on the CSE-CIC-IDS2018 dataset.

Method	Accuracy (%)	Precision (%)	Recall (%)	F1-Score (%)	Time (s)
K-means	94.62	95.18	94.01	94.59	412.5
SVM	95.84	96.02	95.11	95.56	684.3
DT	96.01	96.10	95.91	96.01	87.9
1D CNN	96.22	96.75	95.34	96.19	228.7
kNN	96.70	98.03	95.31	96.65	754.5
RF	97.04	98.46	95.58	96.99	582.6
XGBoost	98.18	97.42	98.18	97.44	642.8
Proposed Method	98.64	98.51	98.59	98.55	318.4

The proposed method again achieves the best overall performance on the CSE-CIC-IDS2018 dataset, reaching 98.64% accuracy with consistently higher precision and recall than all baseline models. Although the performance margin compared to XGBoost is smaller than in the CIC-IDS2017 case, the proposed method maintains a clear advantage while requiring substantially less execution time than ensemble-based tree methods. This demonstrates that the proposed design generalizes well to larger and more complex intrusion detection scenarios.

To better understand the classification performance across the individual traffic classes, confusion matrices were generated for both datasets (see Figure 5 for more details). In both cases, the most samples are correctly classified, which is visible from the strong diagonal values. The largest number of errors appears mainly in the minority attack classes and in the classes with similar traffic characteristics. This behavior reflects the strong class imbalance of the CIC datasets. Overall, the confusion matrices confirm the previously reported quantitative results and show that the proposed model maintains the stable classification performance on both datasets.

Figure 5. Confusion matrices for the CIC-IDS2017 (top) and CSE-CIC-IDS2018 (bottom) datasets.

5.2. Ablation Study

To better understand a contribution of the individual architectural components, an ablation study was conducted on both datasets. Starting from a simplified baseline model that directly applies a single BiGRU layer to the unified input features, components were incrementally added. The results are reported in Table 5.

Table 5. Ablation study of the proposed architecture on the CIC-IDS2017 and CSE-CIC-IDS2018 datasets.

Model Variant	CIC-IDS2017				CSE-CIC-IDS2018
	Acc. (%)	Prec. (%)	Rec. (%)	F1 (%)	Acc. (%)	Prec. (%)	Rec. (%)	F1 (%)
BiGRU baseline	98.87	98.75	98.62	98.68	97.41	97.18	97.06	97.12
+ Multi-scale DSConv block	99.23	99.10	99.05	99.07	97.96	97.82	97.69	97.75
+ SE channel attention	99.41	99.34	99.29	99.31	98.32	98.19	98.11	98.15
+ Temporal attention (full model)	99.56	99.52	99.54	99.53	98.64	98.51	98.59	98.55

The BiGRU baseline achieves a reasonable performance but falls short of the full model. Adding the multi-scale convolutional block leads to a clear improvement in the accuracy and F1-score on both datasets, confirming that parallel kernels with sizes of $k\in \{1,3,5\}$ effectively capture the heterogeneous feature interactions in the tabular network traffic. Introducing the SE channel attention further improves the precision and recall, particularly on the CSE-CIC-IDS2018 dataset, where feature redundancy and noise are more pronounced.

A final addition of the attention pooling to the temporal BiGRU block yields the best performance. This component improves the recall by allowing the model to focus on informative time steps within a flow sequence, which is especially important for detecting short-lived or temporally sparse attack patterns. The ablation results clearly show that no single component alone explains the final performance; instead, the proposed gains result from the complementary effects of all the architectural blocks.

6. Discussion

This study investigates the network intrusion detection using several classical machine learning methods and recent deep learning architectures, with the goal of improving the detection accuracy and robustness on the realistic, large-scale network traffic datasets. The baseline models, such as K-means, SVM, kNN, DT, RF, XGBoost and 1D CNN, were first evaluated, followed by the comparison with the state-of-the-art deep learning approaches and the proposed model.

Firstly, the models were evaluated on the CIC-IDS2017 dataset. As expected, the unsupervised clustering with K-means achieved the lowest accuracy and F1-score due to its inability to exploit the label information in the highly imbalanced setting. This result should be interpreted with a caution because K-means is not a supervised method. It is worth reiterating here that it was included in this study mainly as a traditional reference often reported in the intrusion detection literature, not as a direct competitor to the supervised models. The SVM improved the classification performance but remained below 97% accuracy and required the higher computational time. The kNN classifier further increased the recall, indicating the better detection of the attack samples, but at the cost of very high execution time. The Tree-based models showed the clear performance advantage: the DT and RF both exceeded 99% accuracy, while the XGBoost achieved the best results among the classical methods with 99.41% accuracy. The shallow 1D CNN baseline achieved 99.12% accuracy, confirming that lightweight convolutional models can capture useful feature patterns in network traffic, although its performance remained below the proposed architecture.

The proposed method achieved the highest performance on the CIC-IDS2017 dataset, reaching 99.56% accuracy and an F1-score of 99.53%. Compared to the strongest classical baseline (XGBoost), this corresponds to the accuracy improvement of approximately 0.15% and the F1-score improvement of about 0.13%. Although these numerical gains are relatively small, they translate into a meaningful reduction in misclassified flows given the scale of the dataset. At the same time, the proposed method required the substantially less execution time than the kNN, RF, and XGBoost, indicating the more efficient use of model capacity.

On the more challenging CSE-CIC-IDS2018 dataset, all the methods experienced the noticeable drop in the performance, reflecting the higher traffic diversity and more complex attack scenarios. The K-means and SVM again showed the limited effectiveness, while the kNN and DT achieved the moderate improvements. The 1D CNN baseline achieved 96.22% accuracy on this dataset, again showing the competitive but clearly lower performance compared to the proposed method. The RF and XGBoost remained the strongest classical approaches, with the XGBoost reaching 98.18% accuracy. The proposed method achieved the best overall performance with 98.64% accuracy and an F1-score of 98.55%, corresponding to the accuracy improvement of approximately 0.46% over the XGBoost. This larger margin highlights the advantage of the proposed architecture in more complex detection scenarios.

A comparison with the state-of-the-art deep learning methods reported in Table 6 further supports the effectiveness of the proposed approach. On the CIC-IDS2017 dataset, the existing hybrid and generative-based models already achieve the high detection performance, with reported accuracies ranging from 98.40% to 99.19%. The proposed method attains the highest accuracy of 99.56%, corresponding to an improvement of approximately 0.37% over the GAN-RF and more than 0.5% over the earlier BiLSTM- and CNN + LSTM-based approaches. In terms of the F1-score, the proposed model achieves 99.53%, which is competitive with the recent imbalance-aware architectures while maintaining consistently high precision and recall. On the more challenging CSE-CIC-IDS2018 dataset, the performance gap between methods is more pronounced. The earlier approaches based on autoencoders and shallow deep networks remain below 97% accuracy, while the more advanced architectures such as the DSSTE and TCN + LSTM narrow this gap. The proposed method achieves the best overall performance with an accuracy of 98.64%, improving by approximately 0.26% over the strongest reported deep model and by nearly 0.9% compared to the TCN + LSTM.

Table 6. Comparison with the state-of-the-art methods reported in the literature on the CIC-IDS2017 and CSE-CIC-IDS2018 datasets.

Dataset	Method	Accuracy (%)	Precision (%)	Recall (%)	F1-Score (%)
CIC-IDS2017	BiLSTM [10]	98.40	99.00	96.10	98.20
	CNN + LSTM [6]	98.67	97.21	-	97.21
	IGAN + LSTM [56]	98.97	99.06	98.17	99.73
	GAN-RF [57]	99.19	98.68	92.76	95.04
	Proposed Method	99.56	99.52	99.54	99.53
CSE-CIC-IDS2018	DNN + Autoencoder [2]	95.79	95.38	95.79	95.11
	DSSTE [5]	96.99	97.46	96.97	97.04
	TCN + LSTM [8]	97.77	97.94	97.53	97.73
	DNN [15]	98.38	97.79	97.74	97.76
	Proposed Method	98.64	98.51	98.59	98.55

Note: The results coming from the literature are not strictly comparable with the results reported for the proposed method due to the different dataset splits, preprocessing procedures and metric averaging schemes.

The ablation study provides further insight into the source of these improvements. Starting from the BiGRU baseline, adding the multi-scale convolutional block increased accuracy by approximately 0.36% on the CIC-IDS2017 dataset and 0.55% on the CSE-CIC-IDS2018 dataset, confirming the importance of capturing feature interactions at multiple receptive scales. Introducing the squeeze-and-excitation channel attention yielded the additional improvement of about 0.18–0.36%, particularly improving the recall on the 2018 dataset. The final inclusion of the temporal attention in the BiGRU block resulted in the largest overall gain, improving the F1-score by approximately 0.22% on the CIC-IDS2017 dataset and 0.40% on the CSE-CIC-IDS2018 dataset compared to the model without the attention pooling.

These results show that the performance gains are not solely driven by the model complexity or data scale. Instead, they arise from the carefully selected architectural components that complement each other. The combination of the multi-scale feature interaction, adaptive channel recalibration, and attention-based temporal aggregation enables more reliable detection of diverse and temporally sparse attack patterns, leading to the consistent improvements over both the classical baselines and state-of-the-art deep learning methods. It should be noted here that the attention mechanisms in this work are used primarily to improve the feature weighting and temporal aggregation rather than to provide a model interpretability. Although the attention weights may highlight influential features or time steps, they should not be directly interpreted as explanations without dedicated explainability analysis.

From a deployment perspective, several practical aspects should be noted. Intrusion detection systems usually operate in near real-time conditions where inference speed is more critical than training time, and the proposed model supports batch processing of flow windows as well as sliding-window streaming scenarios. In operational settings, false positive alarms represent a significant cost because they require manual inspection, while missed rare attacks may lead to serious security incidents. Although the precision and recall provide indirect insight into these effects, additional metrics such as false positive rate or PR-AUC may offer a more detailed evaluation under strong class imbalance. Potential limitations include concept drift in evolving network traffic, sensitivity to previously unseen attack patterns, and imbalance typical for intrusion detection datasets. These aspects were not a primary focus of this study but should be considered when deploying the model and remain an important direction for a future evaluation.

7. Conclusions

In this work, we proposed the neural intrusion detection method designed for the flow-based network traffic analysis. The main goal was to address the common challenges in the intrusion detection, including the heterogeneous feature representations, diverse interaction patterns across attack types, and short-term temporal dependencies in network traffic. To this end, we introduced thecompact hybrid architecture that combines the structured feature preprocessing with the multi-scale feature interaction learning, channel-wise attention, and lightweight temporal modeling.

The proposed method was evaluated on two widely used benchmark datasets, i.e., the CIC-IDS2017 and CSE-CIC-IDS2018 dataset. The experimental results demonstrated that the proposed model consistently outperforms the classical machine learning baselines, including kNN, SVM, DT, RF, and XGBoost, across all the evaluated metrics. Compared with the recent state-of-the-art deep learning approaches reported in the literature, the proposed method achieved higher or comparable accuracy, precision, recall, and F1-score on both datasets. On the CIC-IDS2017 dataset, the proposed model improved the accuracy by up to 0.11% over the best competing deep models, while on the more challenging CSE-CIC-IDS2018 dataset it achieved the improvement of up to 0.26%, confirming its strong generalization capability.

The ablation study further confirmed that the observed performance gains are the direct result of the proposed architectural choices. The multi-scale convolutional block enabled the model to capture the feature interactions at different levels of granularity, the channel-wise attention mechanism helped to emphasize the most discriminative features, and the BiGRU with the attention pooling improved the detection of temporally sparse attack behaviors. The best performance was achieved when all components were combined, indicating that each block plays the complementary role in the overall design.

The results show that carefully combining the multi-scale feature interaction learning with the adaptive feature weighting and lightweight temporal modeling leads to the clear improvement in the intrusion detection performance. The proposed approach provides a well-grounded and effective solution for network intrusion detection on modern, large-scale traffic datasets.