Dynamic multi-scale topological representation for enhancing network intrusion detection

Network intrusion detection systems (NIDS) play a crucial role in maintaining network security. However, current NIDS techniques tend to neglect the topological structures of network traffic to varying degrees. This fundamental oversight leads to challenges in handling class-imbalanced and highly dynamic network traffic. In this paper, we propose a novel dynamic multi-scale topological representation (DMTR) method for improving network intrusion detection performance. Our DMTR method achieves the perception of multi-scale topology and exhibits strong robustness. It provides accurate and stable representations even in the presence of data distribution shifts and class imbalance problems. The multi-scale topology is obtained through multiple topology lenses, which reveal topological structures from different dimensional aspects. Furthermore, to address the limitations of existing detection models based on static network traffic, the DMTR method also achieves dynamic topological representation through our proposed group shuffle operation (GSO) strategy. When new traffic data arrives, the topological representation is updated by preserving a portion of the original information without reprocessing all data. Experiments on four publicly available network traffic datasets demonstrate the feasibility and effectiveness of the proposed DMTR method in handling class imbalanced and highly dynamic network traffic.