MFNID: Multiscale Feature Fusion Learning for Self-Supervised Network Intrusion Detection

In practical scenarios, network intrusion detection entails analyzing network traffic and issuing timely alerts to protect against potential malicious activities. However, existing main-stream approaches face inherent limitations in feature extraction. Methods based on convolutional neural network filters primarily capture local patterns, focusing on fine grained details within individual data streams, while approaches leveraging attention mechanisms emphasize global representations, modeling overall traffic distributions. Yet these methods often rely on single level feature representations that are either overly localized or excessively globalized, limiting their ability to holistically characterize complex network traffic patterns. To overcome these challenges, we propose a novel intrusion detection framework called MFNID for network situation awareness, where MFNID integrates a dual contrastive learning paradigm within a unified architecture to jointly extract both local and global feature representations from raw traffic data, thereby enhancing the discriminative power of learned representations for edge classification. Concretely, at the local level, MFNID employs a fine grained dual perspective semantic contrastive learning strategy that compares multiple views of the same node, effectively capturing local semantics and node interactions. At the global level, a topology-aware subgraph level contrastive learning approach models similarities and discrepancies across subgraphs, enabling the extraction of highly abstract semantic information from traffic patterns. For edge level intrusion detection, edge representations are derived by combining the embeddings of incident nodes. Extensive experiments on four benchmark datasets demonstrate that MFNID consistently outperforms state of the art methods in edge classification.