MSC-TGF: A Multi-Scale CNN-Transformer with Graph-Augmented Fusion for Imbalanced Network Intrusion Detection

Abstract

Network intrusion detection based on deep learning is often limited by severe class imbalance and the independent treatment of network flows, which restricts the recognition of minority and coordinated attacks. This paper proposes MSC-TGF, a dual-view intrusion detection framework that integrates multi-scale CNN–Transformer feature learning with graph-augmented gated fusion. The model first employs parallel one-dimensional convolutions to capture local traffic patterns at different receptive fields, and then uses a Transformer encoder to model global dependencies among flow features. A batch-level k-nearest-neighbor graph is further constructed from the learned flow representations, and graph convolution is applied to aggregate inter-flow relational information. The sequence-level and graph-enhanced representations are adaptively combined through a learnable gated fusion module. To mitigate severe class imbalance, a two-stage sampling strategy guarantees minimum coverage for rare attack classes while preserving the relative distribution of the remaining attack traffic. Experiments on the full CSE-CICIDS2018 dataset, containing more than 16 million flow records consolidated into seven traffic categories, show that MSC-TGF achieves 96.67% accuracy and a macro-F1 score of 0.8408. It achieves competitive overall performance and provides notable improvements for minority attacks such as Web Attack and Infiltration. Ablation results further verify the complementary contributions of multi-scale convolution, self-attention, and graph-based relational modeling.