Network intrusion detection, which takes the extraction and analysis of network traffic features as the main method, plays a vital role in network security protection. The current network traffic feature extraction and analysis for network intrusion detection mostly uses deep learning algorithms. Currently, deep learning requires a lot of training resources and has weak processing capabilities for imbalanced datasets. In this paper, a deep learning model (MFVT) based on feature fusion network and vision transformer architecture is proposed, which improves the processing ability of imbalanced datasets and reduces the sample data resources needed for training. Besides, to improve the traditional raw traffic features extraction methods, a new raw traffic features extraction method (CRP) is proposed, and the CPR uses PCA algorithm to reduce all the processed digital traffic features to the specified dimension. On the IDS 2017 dataset and the IDS 2012 dataset, the ablation experiments show that the performance of the proposed MFVT model is significantly better than other network intrusion detection models, and the detection accuracy can reach the state-of-the-art level. And, when MFVT model is combined with CRP algorithm, the detection accuracy is further improved to 99.99%.

网络入侵检测以网络流量特征的提取和分析为主要方法，在网络安全防护中起着至关重要的作用。目前用于网络入侵检测的网络流量特征提取和分析大多采用深度学习算法。目前，深度学习需要大量的训练资源，对不平衡数据集的处理能力较弱。本文提出了一种基于特征融合网络和视觉转换器架构的深度学习模型（MFVT），提高了对不平衡数据集的处理能力，减少了训练所需的样本数据资源。此外，为了改进传统的原始交通特征提取方法，提出了一种新的原始交通特征提取方法（CRP），CPR 使用 PCA 算法将所有处理后的数字流量特征减少到指定的维度。在 IDS 2017 数据集和 IDS 2012 数据集上，消融实验表明，所提出的 MFVT 模型的性能明显优于其他网络入侵检测模型，检测精度可以达到 state-of-the-art 水平。并且，当MFVT模型与CRP算法相结合时，检测精度进一步提高到99.99%。