Abstract: With cyberattacks becoming increasingly sophisticated and covert, improving the representation and recognition of complex traffic patterns has become an important issue in intrusion detection. Although existing methods have improved detection performance, directly modeling complex network traffic still suffers from insufficient feature representation. To enhance local correlations and structural information among features, many studies transform one-dimensional traffic features into two-dimensional image-like representations for deep feature learning. However, limited by feature dimensionality and encoding schemes, such traffic images are usually small and structurally constrained, making fixed enhancement strategies insufficient for capturing differences among attack patterns. Meanwhile, class imbalance further restricts the recognition of minority attack classes. To address these issues, this paper proposes a network intrusion detection method based on dynamic selective feature enhancement. At the representation level, a multi-scale feature enhancement module adaptively fuses features with different receptive fields to alleviate the representation limitations of small traffic images. At the decision level, a dynamic adaptive module combined with minority-class attention selectively strengthens key responses to improve minority-class recognition. Experimental results show that the proposed method achieves 96.49% accuracy, 95.11% precision, 96.32% recall, and 95.50% F1-score on NSL-KDD. It also maintains good detection performance on UNSW-NB15 and shows stable performance in a simulated streaming environment built on TON-IoT-Network.

摘要： 随着网络攻击手段日益复杂和隐蔽，提升入侵检测模型对复杂流量模式的表征与识别能力已成为重要研究问题。现有入侵检测方法虽在一定程度上提升了检测性能，但面对复杂网络流量数据，直接建模仍存在特征表达不足的问题。为强化特征间的局部关联与结构信息，现有研究常将一维流量特征映射为二维类图像表示，以便利用深度模型进行学习。然而，受特征维度及编码方式限制，流量图像通常存在尺寸较小、结构表达受限等问题，固定增强方式难以适应不同攻击模式的表征差异；同时，攻击类别分布不均衡也进一步制约了模型对少数类攻击的识别能力。针对上述问题，本文提出一种基于动态选择性特征增强的网络流量入侵检测方法。该方法以动态选择机制为主线，在表征层通过多尺度特征增强模块按输入内容自适应融合不同感受野特征，以缓解小尺寸流量图像的表征受限问题；在判别层通过动态自适应模块结合少数类注意力，对关键响应进行差异化强化，以提升模型对少数类攻击的识别能力。实验结果表明，该方法在NSL-KDD数据集上取得了96.49%的准确率、95.11%的精确率、96.32%的召回率和95.50%的F1分数；在UNSW-NB15数据集上的实验结果验证了所提方法的良好泛化能力；在TON-IoT-Network数据集构建的模拟流式环境中，模型在连续输入条件下表现出较稳定的检测效果，说明其在在线入侵检测场景中具有一定的适应能力。