Network security situation assessment based on PFEN-MsTCN fusion model

Xincheng GAO, Zhewei CHEN

Journal of Tsinghua University(Science and Technology) ›› 2025, Vol. 65 ›› Issue (11) : 2236-2244.

PDF(2346 KB)
PDF(2346 KB)
Journal of Tsinghua University(Science and Technology) ›› 2025, Vol. 65 ›› Issue (11) : 2236-2244. DOI: 10.16511/j.cnki.qhdxxb.2025.27.055

Network security situation assessment based on PFEN-MsTCN fusion model

Author information +
History +

Abstract

Objective: With the rapid development of network technology, cyberattacks have become increasingly severe, threatening the stability of cyberspace. Network security situation assessment (NSSA) has become a critical technology for building proactive defense systems by integrating multisource data to deliver comprehensive and dynamic evaluations of network states. Traditional rule-based methods and early learning-based models often lack sufficient granularity in feature extraction, struggling to capture long-range temporal dependencies, thereby limiting their effectiveness in detecting complex and diverse attack patterns. To address these limitations, this study proposes a novel evaluation framework that integrates a parallel feature extraction network (PFEN) and a multiscale temporal convolutional network (MsTCN) to enhance fine-grained feature extraction and long-term dependency modeling for network traffic data. Methods: The proposed PFEN-MsTCN model introduces two major technical contributions. First, the PFEN is tailored for sequential traffic data by modifying the conventional Inception module, replacing two-dimensional convolutions with one-dimensional convolutions to extract temporal features along the sequence axis. The multibranch structure is optimized into cascaded subnetworks to capture local and contextual temporal features. The integration of convolution, batch normalization, and ReLU activation enhances nonlinearity and robustness, effectively reducing computational complexity while maintaining feature quality. Second, MsTCN is improved by introducing a multikernel branching structure and a hierarchical dilation rate to dynamically capture multiscale temporal features. A dynamic parameter matching mechanism and Chomp1D layer ensure multibranch output alignment, preventing dimensional mismatches during feature fusion. This design enables the simultaneous detection of short-term bursts and long-range dependencies. Finally, the strengths of PFEN in local feature extraction and MsTCN in sequence modeling are seamlessly integrated, creating a robust hybrid model. Results: Comprehensive experiments on the NSL-KDD and CIC-IDS2017 benchmark datasets involved preprocessing with normalization, one-hot encoding of categorical features, and removal of redundant or invalid features to ensure high-quality input. Experimental results demonstrate that the PFEN-MsTCN model consistently outperforms the baseline models, including PFEN-ABiGRU, SEAE-CNN-BiGRU-AM, CNN-TCN, and Inception1D-MsTCN. On the NSL-KDD dataset, the proposed model achieved an F1-score of 87.39%, surpassing competing methods by 2.54%-4.88%, while maintaining lower mean squared error and mean absolute error values. On the CIC-IDS2017 dataset, the proposed model achieved an outstanding F1-score of 99.87% with reduced prediction error, demonstrating superior adaptability to heterogeneous and imbalanced data. The visualization of situation values further verified that PFEN-MsTCN aligns more closely with the ground truth than competing models. Furthermore, the proposed evaluation index system, incorporating attack impact, probability, and frequency factors, enabled accurate quantification of security situation values and precise risk level classification. Conclusions: The PFEN-MsTCN fusion model effectively addresses the challenges of existing NSSA methods by enhancing feature extraction granularity and improving the capture of long-term temporal dependencies. By integrating multibranch one-dimensional convolutional feature extraction with hierarchical multiscale temporal convolution, the model achieves precise recognition of abnormal traffic behaviors and robust temporal dependency modeling. The experimental results validate the superior performance of the proposed model in terms of accuracy, robustness, and generalization across datasets, establishing its potential as a reliable tool for intelligent network security assessment. Future research will focus on improving the recognition accuracy for small-sample attack types in imbalanced datasets and extending the framework to real-time and large-scale deployment scenarios, further enhancing its applicability in practical cyberspace defense systems.

Key words

network security situation assessment / parallel feature extraction / multi-scale temporal convolutional network / long-range temporal dependencies

Cite this article

Download Citations
Xincheng GAO , Zhewei CHEN. Network security situation assessment based on PFEN-MsTCN fusion model[J]. Journal of Tsinghua University(Science and Technology). 2025, 65(11): 2236-2244 https://doi.org/10.16511/j.cnki.qhdxxb.2025.27.055

References

1
LIU X H , ZHANG H W , ZHANG Y C , et al. Optimal network defense strategy selection method based on evolutionary network game[J]. Security and Communication Networks, 2020, 2020, 5381495.
2
王金恒, 单志龙, 谭汉松, 等. 基于遗传优化PNN神经网络的网络安全态势评估[J]. 计算机科学, 2021, 48 (6): 338- 342.
WANG J H , SHAN Z L , TAN H S , et al. Network security situation assessment based on genetic optimized PNN neural network[J]. Computer Science, 2021, 48 (6): 338- 342.
3
赵冬梅, 宋会倩, 张红斌. 基于时间因子和复合CNN结构的网络安全态势评估[J]. 计算机科学, 2021, 48 (12): 349- 356.
ZHAO D M , SONG H Q , ZHANG H B . Network security situation based on time factor and composite CNN structure[J]. Computer Science, 2021, 48 (12): 349- 356.
4
YANG H Y , ZHANG Z X , XIE L X , et al. Network security situation assessment with network attack behavior classification[J]. International Journal of Intelligent Systems, 2022, 37 (10): 6909- 6927.
5
赵冬梅, 孙明伟, 宿梦月, 等. 基于改进SKNet-SVM的网络安全态势评估[J]. 应用科学学报, 2024, 42 (2): 334- 349.
ZHAO D M , SUN M W , SU M Y , et al. Network security situation assessment based on improved SKNet-SVM[J]. Journal of Applied Sciences, 2024, 42 (2): 334- 349.
6
ZHAO D M , SHEN P C , HAN X Z , et al. Security situation assessment in UAV swarm networks using TransReSE: A Transformer-ResNeXt-SE based approach[J]. Vehicular Communications, 2024, 50, 100842.
7
杨宏宇, 张梓锌, 张良. 基于并行特征提取和改进BiGRU的网络安全态势评估[J]. 清华大学学报(自然科学版), 2022, 62 (5): 842- 848.
YANG H Y , ZHANG Z X , ZHANG L . Network security situation assessments with parallel feature extraction and an improved BiGRU[J]. Journal of Tsinghua University (Science and Technology), 2022, 62 (5): 842- 848.
8
YANG H Y , ZENG R Y , XU G Q , et al. A network security situation assessment method based on adversarial deep learning[J]. Applied Soft Computing, 2021, 102, 107096.
9
郭尚伟, 刘树峰, 李子铭, 等. 基于融合模型的网络安全态势感知方法[J]. 计算机工程, 2024, 50 (11): 1- 9.
GUO S W , LIU S F , LI Z M , et al. Network security situation awareness method based on fusion model[J]. Computer Engineering, 2024, 50 (11): 1- 9.
10
SZEGEDY C, LIU W, JIA Y Q, et al. Going deeper with convolutions[C]//Proceedings of the 2015 IEEE Conference on Computer Vision and Pattern Recognition (CVPR). Boston, USA: IEEE, 2015: 1-9.
11
HEWAGE P , BEHERA A , TROVATI M , et al. Temporal convolutional neural (TCN) network for an effective weather forecasting using time-series data from the local weather station[J]. Soft Computing, 2020, 24 (21): 16453- 16482.
12
邓飞跃, 陈哲, 郝如江, 等. 基于MsTCN-Transformer模型的轴承剩余使用寿命预测研究[J]. 振动与冲击, 2024, 43 (4): 279- 287.
DENG F Y , CHEN Z , HAO R J , et al. Research on bearing remaining useful life prediction based on an MsTCN-Transformer model[J]. Journal of Vibration and Shock, 2024, 43 (4): 279- 287.
13
HOUMB S H , FRANQUEIRA V N L , ENGUM E A . Quantifying security risk level from CVSS estimates of frequency and impact[J]. Journal of Systems and Software, 2010, 83 (9): 1622- 1634.
14
中共中央、国务院印发《国家突发事件总体应急预案》[EB/OL]. (2025-02-25)[2025-05-21]. https://www.news.cn/politics/zywj/20250225/a0c06e30ad36490697fbf780530839e4/c.html.
The Central Committee of the Communist Party of China and the State Council issued the "Overall Emergency Plan for National Emergencies"[EB/OL]. (2025-02-25)[2025-05-21]. https://www.news.cn/politics/zywj/20250225/a0c06e30ad36490697fbf780530839e4/c.html. (in Chinese)
15
SU T T , SUN H Z , ZHU J Q , et al. BAT: Deep learning methods on network intrusion detection using NSL-KDD dataset[J]. IEEE Access, 2020, 8, 29575- 29585.
16
PANIGRAHI R , BORAH S . A detailed analysis of CICIDS2017 dataset for designing Intrusion detection systems[J]. International Journal of Engineering & Technology, 2018, 7 (3.24): 479- 482.
17
MOUSTAFA N , SLAY J . The evaluation of Network anomaly detection systems: Statistical analysis of the UNSW-NB15 data set and the comparison with the KDD99 data set[J]. Information Security Journal: A Global Perspective, 2016, 25 (1-3): 18- 31.
18
高新成, 张宣, 樊本航, 等. 基于改进的CNN-Transformer加密流量分类方法[J]. 吉林大学学报(理学版), 2024, 62 (3): 683- 690.
GAO X C , ZHANG X , FAN B H , et al. Improved CNN-transformer based encrypted traffic classification method[J]. Journal of Jilin University (Science Edition), 2024, 62 (3): 683- 690.

RIGHTS & PERMISSIONS

All rights reserved. Unauthorized reproduction is prohibited.
PDF(2346 KB)

Accesses

Citation

Detail

Sections
Recommended

/