ROEN: Universal dynamic topology-adaptive evolution model for multi-modal mixed network traffic detection

Modern network traffic detection systems face significant challenges in accurately classifying sophisticated cyber attacks. Traditional approaches relying on static traffic features (e.g., port numbers and packet sizes) prove inadequate for capturing the dynamic topological evolution inherent in Advanced Persistent Threats (APTs) and complex intrusions. This limitation stems from overlooking temporal correlations and structural dynamics within network traffic flows. Our investigation identifies this oversight as the primary cause of suboptimal performance in multi-modal traffic recognition, hybrid attack detection, and analysis with incomplete or anomalous data. To address this critical gap, we propose a novel dynamic topology-based method that quantifies evolving network structures through traffic pattern distribution transformations. Departing from traditional attention-based anomaly detection paradigms, our streamlined architecture introduces a dual-thread framework with multi-level feature fusion. This innovative design effectively integrates explicit statistical features with implicit dynamic topology information, achieving improved intrusion detection accuracy while reducing computational complexity. By modeling intrinsic interactions between statistical and topological characteristics, our method reveals latent intrusion patterns through three key innovations: (1) quantitative modeling of network topological dynamics, (2) a lightweight dual-thread architecture for efficient feature fusion, and (3) robust detection mechanisms under data scarcity. To our knowledge, this represents the first universal network intrusion detection framework that efficiently combines dynamic topological analysis with conventional statistical features. Extensive benchmark evaluations demonstrate state-of-the-art performance with significant improvements in AUC (5.8%$\uparrow$) and macro-averaged AUC (7.2%$\uparrow$) over existing methods, while maintaining a 23% lower computational overhead. Our solution establishes a foundation for next-generation intrusion detection systems, providing a generalizable and resource-efficient approach to counter evolving cyber threats. The code and dataset are available at https://github.com/vjkgll/ROEN.git.