A multi-level dynamic sample augmentation and heterogeneous feature fusion framework for intelligent intrusion detection

Abstract

Abstract This paper proposes a hybrid intrusion detection framework that integrates dynamic sample augmentation and heterogeneous feature fusion to address class imbalance and temporal complexity in network traffic. At the data level, an ADASYN–FLS–SMOTEBoost strategy combines adaptive oversampling with Focal Loss–Softmax (FLS) weighting to generate more representative minority samples. At the feature level, a multi-branch CNN with FLS-guided dynamic fusion adaptively integrates heterogeneous traffic features. A hierarchical LSTM (HLSTM) is further employed to capture both short-term bursts and long-term temporal dependencies, enhancing temporal modeling capability. To optimize performance, an improved Grey Wolf Optimizer (IGWO) with chaotic initialization and random-walk learning rate adjustment is introduced for efficient hyperparameter tuning. Experimental results on the NSL-KDD dataset show that the proposed method significantly outperforms existing machine learning and deep learning baselines, achieving up to 10% improvement in Macro-F1 and markedly higher recall for rare attack types such as R2L and U2R, while maintaining stable overall accuracy. The proposed framework demonstrates strong robustness, interpretability, and generalization in complex and imbalanced network intrusion scenarios.