A Multi-Head Attention and Residual Dense Network with Dynamic Sampling for Fine-Grained Network Intrusion Classification

A Multi-Head Attention and Residual Dense Network with Dynamic Sampling for Fine-Grained Network Intrusion Classification

Paper in proceedings outside WoS and Scopus

Network Intrusion Detection Systems are essential for monitoring and analyzing network traffic to detect and prevent unauthorized access, malicious activities, and security breaches in real time. Network intrusion detection systems face persistent challenges in accurately identifying finegrained attack subcategories due to class imbalance, limited feature interactions in tabular data, and variability across different time windows. Models often struggle to capture the hidden patterns required for multi-class classification in imbalanced flow-based datasets. To overcome these limitations, this work proposes a deep learning framework that combines Multi-Head Self-Attention (MHSA) with Residual Dense Blocks (RDBs) for fine-grained intrusion classification. The MHSA layers enable the model to learn complex, non-sequential feature dependencies by attending multiple feature interactions simultaneously. The RDBs enhance depth and gradient stability, facilitating effective learning in deep networks, especially under sparse class conditions. A dynamic sampling strategy is incorporated during training, employing SMOTE for oversampling minority classes and random under-sampling of majority classes to ensure balanced learning. The model is trained and evaluated on the large dataset across four temporal resolutions (5s, 10s, 30s, 60s), targeting classification across 13 subcategories. The proposed architecture achieves a peak accuracy of 99.89% on the 10 -second window and maintains high recall across rare attack types such as recon-dns and brute force-ftp. This methodology demonstrates a robust and scalable solution for real-time, multi-class intrusion detection, offering improvements in accuracy, fairness, and adaptability over existing baseline models.

Network Intrusion Detection Systems are essential for monitoring and analyzing network traffic to detect and prevent unauthorized access, malicious activities, and security breaches in real time. Network intrusion detection systems face persistent challenges in accurately identifying finegrained attack subcategories due to class imbalance, limited feature interactions in tabular data, and variability across different time windows. Models often struggle to capture the hidden patterns required for multi-class classification in imbalanced flow-based datasets. To overcome these limitations, this work proposes a deep learning framework that combines Multi-Head Self-Attention (MHSA) with Residual Dense Blocks (RDBs) for fine-grained intrusion classification. The MHSA layers enable the model to learn complex, non-sequential feature dependencies by attending multiple feature interactions simultaneously. The RDBs enhance depth and gradient stability, facilitating effective learning in deep networks, especially under sparse class conditions. A dynamic sampling strategy is incorporated during training, employing SMOTE for oversampling minority classes and random under-sampling of majority classes to ensure balanced learning. The model is trained and evaluated on the large dataset across four temporal resolutions (5s, 10s, 30s, 60s), targeting classification across 13 subcategories. The proposed architecture achieves a peak accuracy of 99.89% on the 10 -second window and maintains high recall across rare attack types such as recon-dns and brute force-ftp. This methodology demonstrates a robust and scalable solution for real-time, multi-class intrusion detection, offering improvements in accuracy, fairness, and adaptability over existing baseline models.

Network Intrusion Detection; Multi-Head SelfAttention; Residual Dense Network; SMOTE; Deep Learning

Network Intrusion Detection; Multi-Head SelfAttention; Residual Dense Network; SMOTE; Deep Learning

SHUKLA, N.; JOSHI, R.; BURGET, R.; ROSA, M.; DUTTA, M.

2026

03.11.2025

IEEE

2025 17th International Congress on Ultra Modern Telecommunications and Control Systems and Workshops (ICUMT)

266

271

6