ROEN-AMP: breaking the serial bottleneck in graph-based traffic detection via parallel anisotropic evolution

Deep learning-based Network Intrusion Detection Systems (NIDS) have increasingly adopted hybrid architectures to capture complex spatio-temporal dependencies. While our prior research (published in a high-level journal) successfully validated the “Structure-Sequence” paradigm via the ROEN framework, it faces the critical “data sparsity” dilemma in real-world high-speed networks: the inherent isotropic spectral aggregation tends to drown out sparse high-frequency attack signals (e.g., bursty C&C traffic) within massive background noise. To bridge this gap, we propose ROEN-AMP, an evolutionary upgrade designed to maximize the Signal-to-Noise Ratio (SNR) of malicious features while ensuring engineering scalability. We first introduce an Edge-Attribute Augmented Anisotropic Perception mechanism, which explicitly integrates flow-level statistics into the attention scoring to dynamically suppress topological noise without payload inspection. Furthermore, we dismantle the serial latency bottleneck by implementing a Multi-Scale Parallel Temporal Evolution Paradigm; utilizing parallel kernels ({3,5,7}), it captures attack patterns across varying granularities with an O(1) path length. Experimental results on ISCX-IDS2012, CIC-IDS2017, and CIC-UNSW-NB15 demonstrate that ROEN-AMP achieves state-of-the-art performance (F1-score>0.996) and delivers a transformative 40×speedup over serial baselines. With an inference latency of 20.87 μs and a throughput approaching 50,000 flows/s, it fully satisfies industrial real-time requirements.