This study addresses the challenge of class imbalance in network intrusion detection by proposing a multi-stage training-based data augmentation model, VGM-VAEGAN. The model innovatively integrates cross-class feature trans-fer, multimodal feature modeling, and attention-guided adversarial training. First, a “pseudo-neighbor set” is constructed to strengthen inter-class relation-ships. Second, a Variational Gaussian Mixture is used to model the multimodal distribution of key continuous features, capturing complex mani-fold structures. Finally, a phased training strategy is introduced: global features are pre-trained using multi-head attention, followed by parameter freezing to focus on minority-specific patterns during fine-tuning. Experiments on NSL-KDD and CIC-IDS2017 datasets validate the effectiveness of the proposed approach. The generated samples exhibit both majority-class diversity and minority-class semantic fidelity, resulting in a 5–6 percentage point improvement in F1-score over baseline models.