PSAF-Net: A Position-Aware Sparse Encoding and Structure-Aware Fusion Network for Open-Set Network Intrusion Detection

In cybersecurity, intrusion detection systems (IDS) face growing challenges due to increasingly heterogeneous attackpatterns and evolving behaviors, particularly in the recognition of unknown threats. Existing approaches show limitedgeneralization and unstable decision boundaries due to insufficient modeling of structural divergence, distributionalshift, inadequate responsiveness to abrupt local anomalies, and weak multi-scale feature fusion capabilities. To addressthese issues, we propose a position-aware sparse encoding and structure-aware fusion network (PSAF-Net). Specifically,PSAF-Net incorporates a learnable position-aware encoding module to embed temporal positional cues, improving themodeling of heterogeneous communication structures and behavioral trends. It then introduces a sparsity-enhancedencoding module guided by local variation rates, using sliding-window-based attention to highlight abrupt changes andsuppress redundant activations, thereby improving sensitivity to fine-grained anomalies. Finally, a temporal structure?aware feature modeling module (TSAFM) is designed to dynamically integrate multi-receptive-field features through ascale-aware guided attention feature fusion mechanism (SGAFF) and a cross-scale structure-aware gated fusion (CSGF),strengthening the model’s capacity to discriminate under diverse attack modes and shifting distributions. Extensiveexperiments on CIC-IDS2017, UNSW-NB15, and ToN-IoT datasets demonstrate that PSAF-Net significantly outperformsstate-of-the-art methods in unknown threat detection, exhibiting superior detection accuracy and open-set generalization.