TSIDS: Spatial–temporal fusion gating Multilayer Perceptron for network intrusion detection

Abstract

Due to the heterogeneous and dynamic nature of networks, modeling spatiotemporal correlations has become a trend. Although spatiotemporal-based network intrusion detection systems (NIDSs) enhance the performance of intrusion classification, they still suffer from inadequacies in the multi-classification of intrusions and model generalization ability. First, the static attack topologies of network traffic always ignore some important information; Second, the interaction between spatial and temporal dimensions is rarely considered. To mitigate these issues, this paper proposes TSIDS, a spatiotemporal analysis-based approach that extracts the interaction of network behaviors for intrusion detection. TSIDS combines the spatial analysis module to extract spatial information between different events, and the temporal analysis module to learn the temporal dependencies from historical traffic data. To model spatial correlations of temporal features, we propose a feature fusion module based on our customized gating Multilayer Perceptron (cgMLP). The experimental results on four datasets show that our work is effective in intrusion detection, especially multi-classification, and outperforms other baseline methods.