MoE-CNN with Dynamic Feature Selection and CSAM for Network Anomaly Detection
摘要
Network anomaly detection is critical for safeguarding modern network infrastructures against increasingly sophisticated cyber threats. However, recent solutions often struggle with high-dimensional data, imbalanced datasets, and limited generalization to diverse attack patterns. This study introduces a novel Mixture of Experts Convolutional Neural Network (MoE-CNN) model, enhanced with Dynamic Feature Selection (DFS) and a Channel-Spatial Attention Mechanism (CSAM), designed for robust anomaly detection across the CICIDS2017 and NSL-KDD datasets. By integrating convolutional layers, expert-driven feature weighting, and attention mechanisms, the model effectively captures complex network traffic patterns, addressing challenges posed by imbalanced data and varied attack scenarios. Evaluated through ten-fold cross-validation, the MoE-CNN-CSAM-DFS model achieves outstanding performance: on CICIDS2017, it attains a recall of 0.983 and an F1-score of 0.951, significantly outperforming baselines like Informer, Quadratic Discriminant Analysis, CNN, Naive Bayes, and Adaboost; on NSL-KDD, it records an accuracy of 0.9766, precision of 0.9384, recall of 0.8797, and F1-score of 0.8765. SHAP analysis validates the model’s focus on high-impact features, such as packet length metrics, enhancing interpretability. This versatile approach provides a powerful, interpretable solution for real-time network intrusion detection, with future potential to optimize computational efficiency and extend adaptability to additional datasets.