Network Intrusion detection model based on a hybrid ResSCConv and Transformer architecture

Abstract: Network Intrusion Detection (NID) gathers and analyzes data from crucial locations in a network system to detect security policy breaches and possible assaults. As the second line of defense after firewalls, NID provides real-time protection against internal and external threats while maintaining network performance. This research offers a hybrid detection model to overcome drawbacks in existing approaches, such as feature redundancy in signature-based Network Intrusion Detection and Convolutional Neural Network (CNN) models, which combines ResSCConv with Transformer. The ResSCConv module combines ResNet50 with Spatial and Channel Reconstruction Convolution (SCConv) to reduce feature redundancy and enhance feature extraction through spatial and channel reconstruction. Meanwhile, the Transformer module employs multi-head self-attention to model long-range dependencies. By leveraging ResSCConv's deeper network structure, the model extracts richer features, improves training efficiency, and enhances generalization, enabling the detection of complex attack patterns and subtle anomalies. Experiments on the CICIDS2017 and KDDCUP99 datasets show that the model is effective, with 93.9% accuracy and a 4.1% improvement in F1 scores, surpassing previous methods and providing a reliable solution for detecting complex network attacks.