Optimized Feature Learning and Sampling for Robust Network Intrusion Detection Using TCN-BiLSTM

Network intrusion detection systems (NIDS) grapple with three primary hurdles: redundant high-dimensional data (which escalates computational overhead and susceptibility to noise), skewed class distributions (leading to elevated missed detection rates for infrequent attacks), and inadequate fusion of spatiotemporal features (which restricts the analysis of sophisticated multi-stage attacks). We propose a deep spatiotemporal feature fusion method integrating an Optimized Residual Stacked Denoising Autoencoder (Res-SDAE), a BS-T hybrid sampling strategy (BorderlineSMOTE-TomekLinks), and a Temporal Convolutional Network-Bidirectional Long Short-Term Memory model (TCN-BiLSTM). Res-SDAE removes redundant features and suppresses noise. BS-T sampling balances data distribution and reduces class overlap. Furthermore, the TCN-BiLSTM model is employed to capture long-term dependencies and extract bidirectional temporal features. This capability is further enhanced by a self-attention mechanism, which dynamically weights critical spatiotemporal information.Cross-dataset tests on CICIDS2017, NSL-KDD, and UNSW-NB15 show accuracy gains of 2.37 to 16.87 percent, false alarm rate reductions of 0.5 to 4.9 percent, and F1-score improvements of 1.45 to 18.41 percent over baseline models. K-fold cross-validation variance below 0.015 confirms robustness and generalization in complex attack scenarios.