MARNet: An Efficient Two-Stage Intrusion Detection Model Based on Deep Learning

Network intrusion detection is a vital component in contemporary cybersecurity defense frameworks. As network traffic data experiences exponential growth, deep learning-based intrusion detection algorithms have become a hot research topic. However, existing intrusion detection methods commonly exhibit low accuracy, high false positive rates, and poor performance in detecting minority class attacks. To address these challenges, this paper presents an efficient two-stage intrusion detection model, MARNet. MARNet consists of two stages: the first stage is multi-scale feature-classification extraction, where numerical and categorical features in the dataset are processed separately and then fused. The second stage is the classification phase, which employs residual networks and channel attention to automatically and effectively extract features from network traffic, while identifying crucial features. Furthermore, we implemented EQL v2 loss to tackle the problem of class imbalance within the dataset. Experiments were conducted using the UNSW-NB15 and NSL-KDD datasets, After a thorough and comprehensive evaluation on two widely used datasets, the model achieved a multi-class accuracy of 90.55% and a detection rate of 99.51% with a false positive rate of 0.61% on the UNSW-NB15 dataset. On the NSL-KDD dataset, the model’s multi-class accuracy was 99.96%, detection rate was 99.96%, and the false positive rate was 0.01%. The experimental results show that the model surpasses existing ones in accuracy, detection rate, false alarm rate, and detection of minority class attacks, effectively meeting the requirements of modern large-scale intrusion detection systems.