An Intrusion Detection Method for Industrial Internet Fusing Multi-Scale TCN and Transformer Network

Capturing more details and features of traffic data by combining information at different scales is one of the practical approaches to address cybersecurity challenges in industrial environments. TCNs can improve the model’s ability to extract multi-scale information by adjusting the size of the convolutional kernel or the number of convolutional layers. However, the approach still falls short in capturing anomalous patterns hidden in global dependencies, which leads to the model’s accuracy on certain long-duration attack categories with reduced accuracy. This paper proposes a novel industrial intrusion detection based on Multi-scale TCN and Transformer fusion (MTTN). A parallel mechanism is included in MTTN.In the first branch, the TCN is improved in terms of scale and structure to establish the connection between forward and backward traffic sequences and enhance the extraction of multi-scale temporal features of the model. In the second branch, patches with different sizes and dimensions are fed into the Transformer to capture the global multi-scale information of the network traffic. The features from these two branches are fused to improve the model detection performance. A series of experiments on the proposed method on two public datasets (CICIDS2017 and NSL-KDD) demonstrate the effectiveness of the proposed method.