Imbalanced intrusion detection method using parrot optimization and DDIM-enhanced hybrid CNN-transformer

Abstract

Accurate detection of rare attacks is a vital task in network intrusion detection. Although deep learning has superior feature representation capability and has become a mainstream technology in this field, existing methods still perform poorly in identifying rare attacks under long-tailed imbalanced multi-class traffic distribution, which remains a critical bottleneck in real-world deployment. This paper proposes an intrusion detection framework integrating improved parrot optimization (IPO), latent denoising diffusion implicit models (DDIM) and a hybrid CNN-Transformer. IPO balances global exploration and local exploitation via an annealing-greedy mechanism to select highly discriminative low-dimensional features, providing low-noise input for VAE-based Latent-DDIM to generate semantically consistent minority samples and alleviate class imbalance. The hybrid CNN-Transformer model captures local statistical patterns and global dependencies through multi-scale feature fusion, forming an end-to-end closed loop of “feature optimization-data augmentation-model modeling”. Experiments on NSL-KDD show that our method improves accuracy by 6.66%, F1-score by 8.01%, and recall rates of U2R and R2L attacks by 15% and 84.2% respectively compared with the best baseline. Moreover, IPO outperforms other mainstream intelligent algorithms in global optimal solution seeking with swifter convergence. On the dataset enhanced by the IPO-DDIM joint augmentation strategy, the hybrid CNN-Transformer obtains 3.93% higher accuracy and 6.24% higher F1-score, which sufficiently demonstrates the comprehensive superiority of the constructed framework.