Multi-Scale Contrastive Embedding Enhanced Adaptive Intrusion Detection Model

In intrusion detection, while certain unsupervised models can detect unknown attack types using thresholds, they usually fall short to effectively utilize the identified traffic patterns to capture the similarities and differences across traffic flows. As a result, unknown attack traffics are frequently misclassified as normal traffic. To address this issue, this paper proposes a Multi-scale Contrastive Embedding Enhanced Adaptive Intrusion Detection Model (MCE-IDM). It employs hierarchical contrastive learning to integrate known attack types with their associated data features, generating embeddings that are subsequently combined with the original data to train an unsupervised model.Furthermore, a lightweight gradient boosting machine is used for feature selection, which significantly reduces the time complexity during this phase compared to previous models. Experimental results on multiple datasets demonstrates that the proposed model not only exhibits stable performance but also improve the Matthews Correlation Coefficient (MCC) by 15.78 percentage point over baseline models on a highly imbalanced subset of data.The proposed method also consistently achieves competitive results across other subsets.