Network Traffic Intrusion Detection by Convolutional Variational Self-Encoder Incorporating Improved Convolutional Attention

To address the limitations of traditional network intrusion detection methods, which often fail to accurately detect anomalous traffic due to insufficient feature extraction, which leads to the inability to accurately detect anomalous traffic, we propose a novel network intrusion detection method based on Convolutional Variational Autoencoder (ConVAE). This method integrates Multi-Scale Adaptive Convolutional Block Attention (MSA-CBAM) with a CNN classifier for network intrusion detection. First, we introduce MSA-CBAM, which enhances the traditional Convolutional Block Attention (CBAM) by incorporating a multi-scale pooling mechanism. This mechanism captures information across different scales improving the model's sensitivity to multi-scale features. Additionally, we introduce an adaptive weighting mechanism that fuses multi-scale features through both channel-attention and spatial-attention, thereby boosting the model's feature extraction capabilities. The attention mechanism is applied in both the encoder of the ConVAE and the CNN classifier enhancing the model's focus on critical information. The ConVAE is pre-trained on the CICIDS2017 dataset using unsupervised pre-training followed by supervised fine-tuning to enhance its reconstruction capabilities. The CNN classifier is then employed to classify the extracted low-dimensional features. Finally, validation tests on the dataset, conducted using multiple intrusion detection models, demonstrate that our method outperforms other detection techniques in multi-class classification tasks and achieves an F1-score of 93.7%.