Multi-Scale Contrastive Embedding Enhanced Adaptive Intrusion Detection Model

Wang Guixin; Wu Xiaoling; Feng Yongjin; Hoon Heo

doi:10.12052/gdutxb.250011

English Version Journal Login

您当前的位置：

首页 >

文章列表页 >

Multi-Scale Contrastive Embedding Enhanced Adaptive Intrusion Detection Model

更新时间：2026-05-27

- Multi-Scale Contrastive Embedding Enhanced Adaptive Intrusion Detection Model
- Vol. 43, Issue 2, Pages: 30-40(2026)
- 作者机构：
  
  1. 广东工业大学计算机学院,广东,广州,510006
  2. 三星电机有限公司,京畿道,水原市,16674
- 作者简介：
- 基金信息：
- DOI：10.12052/gdutxb.250011
  CLC： TP391
- Published：2026
- 稿件说明：
移动端阅览
王桂鑫, 吴晓鸰, 冯永晋, 等. 多尺度对比嵌入增强的自适应入侵检测模型[J]. 广东工业大学学报, 2026, 43(2): 30-40.
王桂鑫, 吴晓鸰, 冯永晋, 等. 多尺度对比嵌入增强的自适应入侵检测模型[J]. 广东工业大学学报, 2026, 43(2): 30-40. DOI： 10.12052/gdutxb.250011.

DOI： 10.12052/gdutxb.250011

摘要

在入侵检测中，一些无监督模型虽然能够利用阈值发现未知的攻击类型，但这类模型未能充分利用已归纳出的流量模式来捕捉流量间的相似性和差异性，进而导致模型将未知的攻击流量视为正常流量。针对该问题，本文提出了一个多尺度对比嵌入增强的自适应入侵检测模型(Multi-scale Contrastive Embedding Enhanced Adaptive Intrusion Detection Model，MCE-IDM)，基于层次对比学习将已有的攻击类型与其相关数据特征结合产生一个嵌入，再将嵌入与原始数据结合用于训练一个无监督模型。同时，使用轻量级梯度提升机来完成特征选择，有效降低了过往模型在特征选择阶段的时间复杂度。经过数据集验证，不仅模型性能稳定，而且其中一个数据类型极不平衡的数据集子集中的马修斯相关系数(Matthews Correlation Coefficient，MCC) 相比基准模型提高了15.78个百分点，同时在其他子集中也取得了较好的效果。

Abstract

In intrusion detection

while certain unsupervised models can detect unknown attack types using thresholds

they usually fall to effectively utilize the identified traffic patterns to capture the similarities and differences across traffic flows. As a result

unknown attack traffics are frequently misclassified as normal traffic. To address this issue

this paper proposes a Multi-scale Contrastive Embedding Enhanced Adaptive Intrusion Detection Model (MCE-IDM). It employs hierarchical contrastive learning to integrate known attack types with their associated data features

generating embeddings that are subsequently combined with the original data to train an unsupervised model.Furthermore

a lightweight gradient boosting machine is used for feature selection

which significantly reduces the time complexity during this phase compared to previous models. Experimental results on multiple datasets demonstrate that the proposed model not only exhibits stable performance but also improves the Matthews Correlation Coefficient (MCC) by 15.78 percentage points over baseline models on a highly imbalanced subset of data.The proposed method also consistently achieves competitive results across other subsets.

关键词

Keywords

references

PARK W, AHN S. Performance comparison and detection analysis in snort and suricata environment[J]. Wireless Personal Communications, 2017, 94(2): 241-252.

JIA Y, FANG B X, LI A P, et al . Research on cybersecurity defense strategies based on artificial intelligence[J ] . Strategic Study of CAE, 2021, 23(3): 98-105.

LI X, CHEN W, ZHANG Q, et al . Building auto-encoder intrusion detection system based on random forest feature selection[J ] . Computers Security, 2020, 95: 333-349.

ZHANG T, CHEN W, LIU Y, et al . An intrusion detection method based on stacked sparse autoencoder and improved gaussian mixture model[J ] . Computers Security, 2023, 128: 128-154.

LIU H, ZHANG W B. Improved light-weight malicious traffic identification method based on ViT[J]. Journal of Chinese Computer Systems, 2024, 45(2): 388-395.

TAYE M M. Understanding of machine learning with deep learning: architectures, workflow, applications and future directions[J]. Computers, 2023, 12(5): 91-105.

CAI J, LUO J, WANG S, et al . Feature selection in machine learning: a new perspective[J ] . Neurocomputing, 2018, 300: 70-79.

ARP D, QUIRING E, PENDLEBURY F, et al . Dos and don'ts of machine learning in computer security[C ] //Proceedings of the 31st USENIX Security Symposium. Berkeley, CA: USENIX Association, 2022: 3971-3988.

ANTONAKAKIS M, APRIL T, BAILEY M, et al . Understanding the mirai botnet[C ] //Proceedings of the 26th USENIX Security Symposium. Berkeley, CA: USENIX Association, 2017: 1093-1110.

LOUK M H L, TAMA B A. Dual-ids: a bagging-based gradient boosting decision tree model for network anomaly intrusion detection system[J]. Expert Systems with Applications, 2023, 213: 98-110.

VO H V, DU H P, NGUYEN H N. Apelid: enhancing real-time intrusion detection with augmented wgan and parallel ensemble learning[J]. Computers and Security, 2024, 136(5): 10-36.

WEI F, LI H, ZHAO Z, et al . Xnids: explaining deep learning-based network intrusion detection systems for active intrusion responses[C ] //32nd USENIX Security Symposium. Berkeley, CA: USENIX Association, 2023: 4337-4354.

CHEN J Y, LU X T, HUANG X F, et al . Double-Bagging based feature dimension reduction heterogenous integrated intrusion detection[J ] . Computer Engineering Science, 2023, 45(6): 1011-1019.

WANG S, HUANG S C. Intrusion detection method based on ICA algorithm and three-way decisions[J]. Computer Applications and Software, 2024, 41(7): 288-295.

WEI M J, ZHANG X N, LIU Y Z, et al . A network intrusion detection method based on SSA-BRF[J ] . Journal of Hebei University (Natural Science Edition), 2022, 42(5): 552-560.

DISHA R A, WAHEED S. Performance analysis of machine learning models for intrusion detection system using gini impurity-based weighted random forest (giwrf) feature selection technique[J]. Cybersecurity, 2022, 5(1): 230-241.

THABTAH F, HAMMOUD S, KAMALOV F, et al . Data imbalance in classification: experimental evaluation[J ] . Information Sciences, 2020, 513: 429-441.

SHARAFALDIN I, HABIBI L A, GHORBANI A A. Toward generating a new intrusion detection dataset and intrusion traffic characterization[C]//International Conference on Information Systems Security and Privacy. Setúbal, Portugal: SCITEPRESS - Science and Technology Publications, 2018: 821-834.

CHICCO D, JURMAN G. The advantages of the matthews correlation coefficient (MCC) over F1 score and accuracy in binary classification evaluation[J]. BMC Genomics, 2020, 21(1): 128-141.

CHEN Y, DING Z, WAGNER D. Continuous learning for android malware detection[C]//32nd USENIX Security Symposium. Berkeley, CA: USENIX Association, 2023: 1127-1144.

KE G, MENG Q, FINLEY T, et al . LightGBM: a highly efficient gradient boosting decision tree[C ] // Advances in Neural Information Processing Systems. Red Hook, NY: Curran Associates, Inc. 2017: 3147-3155.

CHEN H, WANG H W, JIN H B. Intrusion detection model combining improved self-encoder and residual network[J]. Computer Engineering, 2024, 50(2): 188-195.

WANG X Y, WU X L, FENG Y J. Network intrusion detection method combining over-undersampling and GAN[J]. Journal of Chinese Computer Systems, 2024, 41(7): 288-295.

TENG S H, CHEN C, HUO Y X. A multi-fold self-correction small-sample classifier for intrusion detection[J]. Journal of Guangdong University of Technology, 2020, 37(3): 9-16.

Views

下载量

CSCD

Alert me when the article has been cited

提交

Tools

Publicity Resources

A Multi-Fold Self-Correction Small-Sample Classifier for Intrusion Detection

The Study of Bro: a System for Detecting Network Intruder in Real-time

The Application of Data Mining Technology in Anomaly Detection

Research on Foreign Object Detection in Power Transmission Lines Based on the AAGV-YOLOX Model

Efficient Temporal Modeling for RGB-T Tracking

Related Author

Teng Shao-hua

Chen Cheng

Huo Ying-xiang

ZHAO Yu-ming

Zhang Wei

Teng Shao-hua

WU Nai-qi

Related Institution

School of Computers, Guangdong University of Technology

AI问答

⁰