PSAF-Net: A Position-Aware Sparse Encoding and Structure-Aware Fusion Network for Open-Set Network Intrusion Detection

In cybersecurity, intrusion detection systems (IDS) face growing challenges due to increasingly heterogeneous attackpatterns and evolving behaviors, particularly in the recognition of unknown threats. Existing approaches show limitedgeneralization and unstable decision boundaries due to insufficient modeling of structural divergence, distributionalshift, inadequate responsiveness to abrupt local anomalies, and weak multi-scale feature fusion capabilities. To addressthese issues, we propose a position-aware sparse encoding and structure-aware fusion network (PSAF-Net). Specifically,PSAF-Net incorporates a learnable position-aware encoding module to embed temporal positional cues, improving themodeling of heterogeneous communication structures and behavioral trends. It then introduces a sparsity-enhancedencoding module guided by local variation rates, using sliding-window-based attention to highlight abrupt changes andsuppress redundant activations, thereby improving sensitivity to fine-grained anomalies. Finally, a temporal structure?aware feature modeling module (TSAFM) is designed to dynamically integrate multi-receptive-field features through ascale-aware guided attention feature fusion mechanism (SGAFF) and a cross-scale structure-aware gated fusion (CSGF),strengthening the model’s capacity to discriminate under diverse attack modes and shifting distributions. Extensiveexperiments on CIC-IDS2017, UNSW-NB15, and ToN-IoT datasets demonstrate that PSAF-Net significantly outperformsstate-of-the-art methods in unknown threat detection, exhibiting superior detection accuracy and open-set generalization.

在网络安全领域，入侵检测系统（Intrusion Detection Systems, IDS）正面临日益严峻的挑战：攻击模式愈发异构、攻击行为持续演进，尤其在未知威胁识别方面存在诸多难点。现有方法由于对结构差异、分布偏移的建模不足，对局部突发异常的响应能力欠缺，且多尺度特征融合能力薄弱，导致泛化能力有限、决策边界不稳定。针对上述问题，本文提出一种位置感知稀疏编码与结构感知融合网络（PSAF-Net）。具体而言，PSAF-Net首先嵌入可学习位置感知编码模块以提取时序位置线索，提升对异构通信结构与行为趋势的建模能力；随后引入基于局部变化率引导的稀疏增强编码模块，通过滑动窗口注意力机制突出突变特征并抑制冗余激活，从而增强对细粒度异常的敏感度；最后设计时序结构感知特征建模模块（TSAFM），通过尺度感知引导注意力特征融合机制（SGAFF）与跨尺度结构感知门控融合（CSGF）动态整合多感受野特征，强化模型在多样化攻击模式与分布偏移场景下的判别能力。在CIC-IDS2017、UNSW-NB15与ToN-IoT数据集上开展的大量实验表明，PSAF-Net在未知威胁检测任务中显著优于当前最优方法，展现出更优异的检测精度与开放集泛化能力。