针对现有网络安全态势评估模型存在特征提取粒度不足与长序列依赖捕捉能力薄弱的问题,该文提出一种融合并行特征提取网络(PFEN)与多尺度时间卷积网络(MsTCN)的评估模型。首先,从3个方面改进PFEN,以一维卷积替代二维卷积,优化分支结构,融合多种组件,有效增强特征提取能力,更为精准地提取流量异常行为模式和关键特征;其次,针对现有MsTCN存在膨胀率、核大小固定的局限,引入多核分支结构与层级化膨胀率对其进行改进,结合动态参数匹配策略以及Chomp1D层,有效解决多分支协同维度对齐问题,实现多尺度特征的动态覆盖和对复杂时序特征的全面捕捉;最后,将擅长局部特征提取的PFEN和适用于处理长期依赖关系的MsTCN有机融合,弥补单一模型的不足。通过NSL-KDD和CIC-IDS2017数据集的实验分析,模型在精确率、召回率和F1值上均优于对比模型,其中F1值在NSL-KDD和CIC-IDS2017数据集上分别达到87.39%和99.87%,验证了该方法的有效性和准确性。
Objective: With the rapid development of network technology, cyberattacks have become increasingly severe, threatening the stability of cyberspace. Network security situation assessment (NSSA) has become a critical technology for building proactive defense systems by integrating multisource data to deliver comprehensive and dynamic evaluations of network states. Traditional rule-based methods and early learning-based models often lack sufficient granularity in feature extraction, struggling to capture long-range temporal dependencies, thereby limiting their effectiveness in detecting complex and diverse attack patterns. To address these limitations, this study proposes a novel evaluation framework that integrates a parallel feature extraction network (PFEN) and a multiscale temporal convolutional network (MsTCN) to enhance fine-grained feature extraction and long-term dependency modeling for network traffic data. Methods: The proposed PFEN-MsTCN model introduces two major technical contributions. First, the PFEN is tailored for sequential traffic data by modifying the conventional Inception module, replacing two-dimensional convolutions with one-dimensional convolutions to extract temporal features along the sequence axis. The multibranch structure is optimized into cascaded subnetworks to capture local and contextual temporal features. The integration of convolution, batch normalization, and ReLU activation enhances nonlinearity and robustness, effectively reducing computational complexity while maintaining feature quality. Second, MsTCN is improved by introducing a multikernel branching structure and a hierarchical dilation rate to dynamically capture multiscale temporal features. A dynamic parameter matching mechanism and Chomp1D layer ensure multibranch output alignment, preventing dimensional mismatches during feature fusion. This design enables the simultaneous detection of short-term bursts and long-range dependencies. Finally, the strengths of PFEN in local feature extraction and MsTCN in sequence modeling are seamlessly integrated, creating a robust hybrid model. Results: Comprehensive experiments on the NSL-KDD and CIC-IDS2017 benchmark datasets involved preprocessing with normalization, one-hot encoding of categorical features, and removal of redundant or invalid features to ensure high-quality input. Experimental results demonstrate that the PFEN-MsTCN model consistently outperforms the baseline models, including PFEN-ABiGRU, SEAE-CNN-BiGRU-AM, CNN-TCN, and Inception1D-MsTCN. On the NSL-KDD dataset, the proposed model achieved an F1-score of 87.39%, surpassing competing methods by 2.54%-4.88%, while maintaining lower mean squared error and mean absolute error values. On the CIC-IDS2017 dataset, the proposed model achieved an outstanding F1-score of 99.87% with reduced prediction error, demonstrating superior adaptability to heterogeneous and imbalanced data. The visualization of situation values further verified that PFEN-MsTCN aligns more closely with the ground truth than competing models. Furthermore, the proposed evaluation index system, incorporating attack impact, probability, and frequency factors, enabled accurate quantification of security situation values and precise risk level classification. Conclusions: The PFEN-MsTCN fusion model effectively addresses the challenges of existing NSSA methods by enhancing feature extraction granularity and improving the capture of long-term temporal dependencies. By integrating multibranch one-dimensional convolutional feature extraction with hierarchical multiscale temporal convolution, the model achieves precise recognition of abnormal traffic behaviors and robust temporal dependency modeling. The experimental results validate the superior performance of the proposed model in terms of accuracy, robustness, and generalization across datasets, establishing its potential as a reliable tool for intelligent network security assessment. Future research will focus on improving the recognition accuracy for small-sample attack types in imbalanced datasets and extending the framework to real-time and large-scale deployment scenarios, further enhancing its applicability in practical cyberspace defense systems.