Network anomaly detection is critical for safeguarding modern network infrastructures against increasingly sophisticated cyber threats. However, recent solutions often struggle with high-dimensional data, imbalanced datasets, and limited generalization to diverse attack patterns. This study introduces a novel Mixture of Experts Convolutional Neural Network (MoE-CNN) model, enhanced with Dynamic Feature Selection (DFS) and a Channel-Spatial Attention Mechanism (CSAM), designed for robust anomaly detection across the CICIDS2017 and NSL-KDD datasets. By integrating convolutional layers, expert-driven feature weighting, and attention mechanisms, the model effectively captures complex network traffic patterns, addressing challenges posed by imbalanced data and varied attack scenarios. Evaluated through ten-fold cross-validation, the MoE-CNN-CSAM-DFS model achieves outstanding performance: on CICIDS2017, it attains a recall of 0.983 and an F1-score of 0.951, significantly outperforming baselines like Informer, Quadratic Discriminant Analysis, CNN, Naive Bayes, and Adaboost; on NSL-KDD, it records an accuracy of 0.9766, precision of 0.9384, recall of 0.8797, and F1-score of 0.8765. SHAP analysis validates the model’s focus on high-impact features, such as packet length metrics, enhancing interpretability. This versatile approach provides a powerful, interpretable solution for real-time network intrusion detection, with future potential to optimize computational efficiency and extend adaptability to additional datasets.

错误:搜索内容不能为空,请输入英文关键词
错误:关键词超出字数限制,请精简
高级检索

MoE-CNN with Dynamic Feature Selection and CSAM for Network Anomaly Detection

  • Xinxin Wen,
  • Xianfeng Guo,
  • Xinyue Yan,
  • Jiaxi Li,
  • Hongyi Li

摘要

Network anomaly detection is critical for safeguarding modern network infrastructures against increasingly sophisticated cyber threats. However, recent solutions often struggle with high-dimensional data, imbalanced datasets, and limited generalization to diverse attack patterns. This study introduces a novel Mixture of Experts Convolutional Neural Network (MoE-CNN) model, enhanced with Dynamic Feature Selection (DFS) and a Channel-Spatial Attention Mechanism (CSAM), designed for robust anomaly detection across the CICIDS2017 and NSL-KDD datasets. By integrating convolutional layers, expert-driven feature weighting, and attention mechanisms, the model effectively captures complex network traffic patterns, addressing challenges posed by imbalanced data and varied attack scenarios. Evaluated through ten-fold cross-validation, the MoE-CNN-CSAM-DFS model achieves outstanding performance: on CICIDS2017, it attains a recall of 0.983 and an F1-score of 0.951, significantly outperforming baselines like Informer, Quadratic Discriminant Analysis, CNN, Naive Bayes, and Adaboost; on NSL-KDD, it records an accuracy of 0.9766, precision of 0.9384, recall of 0.8797, and F1-score of 0.8765. SHAP analysis validates the model’s focus on high-impact features, such as packet length metrics, enhancing interpretability. This versatile approach provides a powerful, interpretable solution for real-time network intrusion detection, with future potential to optimize computational efficiency and extend adaptability to additional datasets.