Scholarlink

<p>Accurate detection of rare attacks is a vital task in network intrusion detection. Although deep learning has superior feature representation capability and has become a mainstream technology in this field, existing methods still perform poorly in identifying rare attacks under long-tailed imbalanced multi-class traffic distribution, which remains a critical bottleneck in real-world deployment. This paper proposes an intrusion detection framework integrating improved parrot optimization (IPO), latent denoising diffusion implicit models (DDIM) and a hybrid CNN-Transformer. IPO balances global exploration and local exploitation via an annealing-greedy mechanism to select highly discriminative low-dimensional features, providing low-noise input for VAE-based Latent-DDIM to generate semantically consistent minority samples and alleviate class imbalance. The hybrid CNN-Transformer model captures local statistical patterns and global dependencies through multi-scale feature fusion, forming an end-to-end closed loop of “feature optimization-data augmentation-model modeling”. Experiments on NSL-KDD show that our method improves accuracy by 6.66%, F1-score by 8.01%, and recall rates of U2R and R2L attacks by 15% and 84.2% respectively compared with the best baseline. Moreover, IPO outperforms other mainstream intelligent algorithms in global optimal solution seeking with swifter convergence. On the dataset enhanced by the IPO-DDIM joint augmentation strategy, the hybrid CNN-Transformer obtains 3.93% higher accuracy and 6.24% higher F1-score, which sufficiently demonstrates the comprehensive superiority of the constructed framework.</p>

错误：搜索内容不能为空，请输入英文关键词
错误：关键词超出字数限制，请精简
高级检索

Imbalanced intrusion detection method using parrot optimization and DDIM-enhanced hybrid CNN-transformer

  • 期刊论文

  • 出版模式：

    开放获取

  • 发表日期：

    2026年7月14日

查看全文
  • Huanchi Luo,
  • Gen Li,
  • Yong Tang

摘要

Accurate detection of rare attacks is a vital task in network intrusion detection. Although deep learning has superior feature representation capability and has become a mainstream technology in this field, existing methods still perform poorly in identifying rare attacks under long-tailed imbalanced multi-class traffic distribution, which remains a critical bottleneck in real-world deployment. This paper proposes an intrusion detection framework integrating improved parrot optimization (IPO), latent denoising diffusion implicit models (DDIM) and a hybrid CNN-Transformer. IPO balances global exploration and local exploitation via an annealing-greedy mechanism to select highly discriminative low-dimensional features, providing low-noise input for VAE-based Latent-DDIM to generate semantically consistent minority samples and alleviate class imbalance. The hybrid CNN-Transformer model captures local statistical patterns and global dependencies through multi-scale feature fusion, forming an end-to-end closed loop of “feature optimization-data augmentation-model modeling”. Experiments on NSL-KDD show that our method improves accuracy by 6.66%, F1-score by 8.01%, and recall rates of U2R and R2L attacks by 15% and 84.2% respectively compared with the best baseline. Moreover, IPO outperforms other mainstream intelligent algorithms in global optimal solution seeking with swifter convergence. On the dataset enhanced by the IPO-DDIM joint augmentation strategy, the hybrid CNN-Transformer obtains 3.93% higher accuracy and 6.24% higher F1-score, which sufficiently demonstrates the comprehensive superiority of the constructed framework.