{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,7,30]],"date-time":"2025-07-30T16:31:33Z","timestamp":1753893093762,"version":"3.41.2"},"reference-count":48,"publisher":"Frontiers Media SA","license":[{"start":{"date-parts":[[2025,5,12]],"date-time":"2025-05-12T00:00:00Z","timestamp":1747008000000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"content-domain":{"domain":["frontiersin.org"],"crossmark-restriction":true},"short-container-title":["Front. Commun. Netw."],"abstract":"<jats:p>With the advancement of Internet of Things (IoT) technology, the continuous growth of IoT systems has resulted in the accumulation of massive amounts of data. Consequently, there has been a sharp increase in network attacks, highlighting the need for enhanced network security methods. Network intrusion detection systems play a crucial role in network security. Compared to the traditional approach of using single time-series models to process traffic data, this study innovatively proposes an RMCLA (Residual Network and Multi-scale Convolution Long Short-Term Memory with Attention Mechanisms) network intrusion detection system optimized with attention and residual mechanisms. This model converts traffic data into feature images and enhances the feature contrast through histogram equalization. It then utilizes the powerful performance of convolutional networks to extract abnormal feature points. The attention module and residual network enhance the focus on abnormal points, reducing feature loss and redundancy, thereby achieving effective classification of traffic image processing. We conducted experiments on the CIC-IDS2017 and UNSW-NB15 datasets and compared our model with the latest research models. This study highlights the potential of combining deep learning techniques with advanced attention and residual networks to enhance network security in IoT environments. The results show that combining image recognition with attention-residual optimization can effectively improve network intrusion detection capabilities.<\/jats:p>","DOI":"10.3389\/frcmn.2025.1546936","type":"journal-article","created":{"date-parts":[[2025,5,12]],"date-time":"2025-05-12T05:39:00Z","timestamp":1747028340000},"update-policy":"https:\/\/doi.org\/10.3389\/crossmark-policy","source":"Crossref","is-referenced-by-count":0,"title":["Abnormal traffic detection based on image recognition and attention-residual optimization"],"prefix":"10.3389","volume":"6","author":[{"given":"Pengfei","family":"Wang","sequence":"first","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Xinpeng","family":"Chen","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Jinan","family":"Shen","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Zhenwu","family":"Xu","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Fang","family":"Liang","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Qiuyang","family":"Du","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"1965","published-online":{"date-parts":[[2025,5,12]]},"reference":[{"key":"B1","doi-asserted-by":"publisher","first-page":"101322","DOI":"10.1016\/j.jestch.2022.101322","article-title":"A hybrid cnn+ lstm-based intrusion detection system for industrial iot networks","volume":"38","author":"Altunay","year":"2023","journal-title":"Eng. Sci. Technol. Int. J."},{"key":"B2","doi-asserted-by":"publisher","first-page":"233","DOI":"10.1089\/big.2020.0263","article-title":"A convolutional neural network for improved anomaly-based network intrusion detection","volume":"9","author":"Al-Turaiki","year":"2021","journal-title":"Big Data"},{"key":"B3","doi-asserted-by":"publisher","first-page":"106798","DOI":"10.1016\/j.knosys.2021.106798","article-title":"Nearest cluster-based intrusion detection through convolutional neural networks","volume":"216","author":"Andresini","year":"2021","journal-title":"Knowledge-Based Syst."},{"key":"B4","doi-asserted-by":"publisher","first-page":"848","DOI":"10.1007\/s12559-018-9564-y","article-title":"Anomaly-based intrusion detection using extreme learning machine and aggregation of network traffic statistics in probability space","volume":"10","author":"Atli","year":"2018","journal-title":"Cogn. Comput."},{"key":"B5","doi-asserted-by":"crossref","first-page":"274","DOI":"10.1109\/ICITM48982.2020.9080392","article-title":"Digital transformation of the world economy: evaluation of the global and Russian internet of things markets","volume-title":"2020 9th international conference on industrial technology and management (ICITM)","author":"Bataev","year":"2020"},{"key":"B6","doi-asserted-by":"crossref","first-page":"377","DOI":"10.1007\/978-3-031-17551-0_25","article-title":"An intrusion detection system based on deep belief networks","volume-title":"International conference on science of cyber security","author":"Belarbi","year":"2022"},{"key":"B7","doi-asserted-by":"publisher","first-page":"7094","DOI":"10.1007\/s10489-021-02205-9","article-title":"Unsupervised deep learning approach for network intrusion detection combining convolutional autoencoder and one-class svm","volume":"51","author":"Binbusayyis","year":"2021","journal-title":"Appl. Intell."},{"key":"B8","doi-asserted-by":"publisher","first-page":"893","DOI":"10.1007\/s10207-023-00663-5","article-title":"Blocnet: a hybrid, dataset-independent intrusion detection system using deep learning","volume":"22","author":"Bowen","year":"2023","journal-title":"Int. J. Inf. Secur."},{"key":"B9","doi-asserted-by":"crossref","first-page":"243","DOI":"10.1109\/CBD51900.2020.00051","article-title":"A novel network intrusion detection system based on cnn","volume-title":"2020 eighth international conference on advanced cloud and big data (CBD)","author":"Chen","year":"2020"},{"key":"B10","doi-asserted-by":"publisher","first-page":"213","DOI":"10.1016\/J.PROCS.2016.06.047","article-title":"Random forest modeling for network intrusion detection system","volume":"89","author":"Farnaaz","year":"2016","journal-title":"Procedia Comput. Sci."},{"key":"B11","doi-asserted-by":"publisher","first-page":"8788","DOI":"10.3390\/s23218788","article-title":"Multi-classification and tree-based ensemble network for the intrusion detection system in the internet of vehicles","volume":"23","author":"Gou","year":"2023","journal-title":"Sensors"},{"key":"B12","doi-asserted-by":"publisher","first-page":"1218","DOI":"10.1109\/jsac.2020.2986618","article-title":"A network function virtualization system for detecting malware in large iot based networks","volume":"38","author":"Guizani","year":"2020","journal-title":"IEEE J. Sel. Areas Commun."},{"key":"B13","doi-asserted-by":"publisher","first-page":"99837","DOI":"10.1109\/access.2022.3206425","article-title":"Cnn-lstm: hybrid deep neural network for network intrusion detection system","volume":"10","author":"Halbouni","year":"2022","journal-title":"IEEE Access"},{"key":"B14","doi-asserted-by":"publisher","first-page":"97780","DOI":"10.1109\/access.2022.3200034","article-title":"Network intrusion detection via flow-to-image conversion and vision transformer classification","volume":"10","author":"Ho","year":"2022","journal-title":"IEEE Access"},{"key":"B15","doi-asserted-by":"publisher","first-page":"769","DOI":"10.1007\/s12530-019-09317-1","article-title":"Anomaly process detection using negative selection algorithm and classification techniques","volume":"12","author":"Hosseini","year":"2021","journal-title":"Evol. Syst."},{"key":"B16","first-page":"1","article-title":"Network intrusion detection method based on naive bayes algorithm","volume-title":"2022 6th asian conference on artificial intelligence technology (ACAIT)","author":"Huang","year":"2022"},{"key":"B17","doi-asserted-by":"crossref","first-page":"506","DOI":"10.1109\/3ICT53449.2021.9581404","article-title":"A novel deep learning based intrusion detection system: software defined network","volume-title":"2021 International Conference on innovation and intelligence for informatics, computing, and technologies (3ICT)","author":"Hussain","year":"2021"},{"key":"B18","doi-asserted-by":"publisher","first-page":"462","DOI":"10.1016\/J.JKSUCI.2015.12.004","article-title":"Intrusion detection model using fusion of chi-square feature selection and multi class svm","volume":"29","author":"Ikram","year":"2017","journal-title":"J. King Saud. Univ. Comput. Inf. Sci."},{"key":"B19","doi-asserted-by":"publisher","first-page":"32464","DOI":"10.1109\/access.2020.2973730","article-title":"Network intrusion detection combined hybrid sampling with deep hierarchical network","volume":"8","author":"Jiang","year":"2020","journal-title":"IEEE access"},{"key":"B20","doi-asserted-by":"publisher","first-page":"107132","DOI":"10.1016\/j.knosys.2021.107132","article-title":"Unified deep learning approach for efficient intrusion detection system using integrated spatial\u2013temporal features","volume":"226","author":"Kanna","year":"2021","journal-title":"Knowledge-Based Syst."},{"key":"B21","doi-asserted-by":"publisher","first-page":"7859","DOI":"10.1007\/s00521-019-04187-9","article-title":"Hybrid intrusion detection and signature generation using deep recurrent neural networks","volume":"32","author":"Kaur","year":"2020","journal-title":"Neural Comput. Appl."},{"key":"B22","doi-asserted-by":"publisher","first-page":"1051","DOI":"10.1007\/s00521-016-2418-1","article-title":"An effective combining classifier approach using tree algorithms for network intrusion detection","volume":"28","author":"Kevric","year":"2017","journal-title":"Neural Comput. Appl."},{"key":"B23","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1109\/WINCOM55661.2022.9966426","article-title":"Improving intrusion detection using pca and k-means clustering algorithm","volume-title":"2022 9th international conference on wireless networks and mobile communications (WINCOM)","author":"Khaoula","year":"2022"},{"key":"B24","doi-asserted-by":"publisher","first-page":"8707","DOI":"10.3390\/su14148707","article-title":"Xgboost for imbalanced multiclass classification-based industrial internet of things intrusion detection systems","volume":"14","author":"Le","year":"2022","journal-title":"Sustainability"},{"key":"B25","doi-asserted-by":"publisher","first-page":"64957","DOI":"10.1109\/access.2023.3289200","article-title":"Abnormal traffic detection based on attention and big step convolution","volume":"11","author":"Li","year":"2023","journal-title":"IEEE Access"},{"key":"B26","doi-asserted-by":"publisher","first-page":"107450","DOI":"10.1016\/j.measurement.2019.107450","article-title":"Robust detection for network intrusion of industrial iot based on multi-cnn fusion","volume":"154","author":"Li","year":"2020","journal-title":"Measurement"},{"key":"B27","doi-asserted-by":"publisher","first-page":"119030","DOI":"10.1016\/j.eswa.2022.119030","article-title":"Dual-ids: a bagging-based gradient boosting decision tree model for network anomaly intrusion detection system","volume":"213","author":"Louk","year":"2022","journal-title":"Expert Syst. Appl."},{"key":"B28","doi-asserted-by":"publisher","first-page":"e00497","DOI":"10.1016\/j.sciaf.2020.e00497","article-title":"Network intrusion detection system using supervised learning paradigm","volume":"9","author":"Mebawondu","year":"2020","journal-title":"Sci. Afr."},{"key":"B29","doi-asserted-by":"publisher","first-page":"5829","DOI":"10.3390\/s23135829","article-title":"Multi-layered filtration framework for efficient detection of network attacks using machine learning","volume":"23","author":"Paracha","year":"2023","journal-title":"Sensors"},{"key":"B30","doi-asserted-by":"publisher","first-page":"103403","DOI":"10.1016\/j.dsp.2022.103403","article-title":"A structured review of sparse fast fourier transform algorithms","volume":"123","author":"Rajaby","year":"2022","journal-title":"Digit. Signal Process."},{"key":"B31","doi-asserted-by":"publisher","first-page":"108156","DOI":"10.1016\/j.compeleceng.2022.108156","article-title":"Recurrent deep learning-based feature fusion ensemble meta-classifier approach for intelligent network intrusion detection system","volume":"102","author":"Ravi","year":"2022","journal-title":"Comput. Electr. Eng."},{"key":"B32","doi-asserted-by":"crossref","first-page":"0452","DOI":"10.1109\/CCWC.2019.8666588","article-title":"Deep learning models for cyber security in iot networks","volume-title":"2019 IEEE 9th annual computing and communication workshop and conference (CCWC)","author":"Roopak","year":"2019"},{"key":"B33","doi-asserted-by":"publisher","first-page":"138732","DOI":"10.1109\/access.2023.3340142","article-title":"Cnn-bilstm: a hybrid deep learning approach for network intrusion detection system in software defined networking with hybrid feature selection","volume":"11","author":"Said","year":"2023","journal-title":"IEEE Access"},{"key":"B34","doi-asserted-by":"publisher","first-page":"479","DOI":"10.3390\/app14020479","article-title":"Enhanced intrusion detection with lstm-based model, feature selection, and smote for imbalanced data","volume":"14","author":"Sayegh","year":"2024","journal-title":"Appl. Sci."},{"key":"B35","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1155\/2020\/8890306","article-title":"Dl-ids: extracting features using cnn-lstm hybrid network for intrusion detection system","volume":"2020","author":"Sun","year":"2020","journal-title":"Secur. Commun. Netw."},{"key":"B36","doi-asserted-by":"publisher","first-page":"103405","DOI":"10.1016\/j.jisa.2022.103405","article-title":"A dependable hybrid machine learning model for network intrusion detection","volume":"72","author":"Talukder","year":"2022","journal-title":"ArXiv abs\/2212.04546"},{"key":"B37","doi-asserted-by":"publisher","first-page":"41525","DOI":"10.1109\/access.2019.2895334","article-title":"Deep learning approach for intelligent intrusion detection system","volume":"7","author":"Vinayakumar","year":"2019","journal-title":"Ieee Access"},{"key":"B38","doi-asserted-by":"publisher","DOI":"10.1155\/2021\/6632671","article-title":"Mining network traffic with the k -means clustering algorithm for stepping-stone intrusion detection","volume":"2021","author":"Wang","year":"","journal-title":"Wirel. Commun. Mob. Comput."},{"key":"B39","doi-asserted-by":"publisher","first-page":"1139","DOI":"10.1109\/tdsc.2022.3148990","article-title":"Manda: on adversarial example detection for network intrusion detection system","volume":"20","author":"Wang","year":"2022","journal-title":"IEEE Trans. Dependable Secure Comput."},{"key":"B40","doi-asserted-by":"publisher","first-page":"16062","DOI":"10.1109\/access.2021.3051074","article-title":"Deep belief network integrating improved kernel-based extreme learning machine for network intrusion detection","volume":"9","author":"Wang","year":"","journal-title":"IEEE Access"},{"key":"B41","doi-asserted-by":"publisher","first-page":"64375","DOI":"10.1109\/access.2022.3182333","article-title":"Rtids: a robust transformer-based approach for intrusion detection system","volume":"10","author":"Wu","year":"2022","journal-title":"IEEE Access"},{"key":"B42","doi-asserted-by":"crossref","first-page":"579","DOI":"10.1109\/MILCOM.2018.8599821","article-title":"Deepgfl: deep feature learning via graph for attack detection on flow-based network traffic","volume-title":"MILCOM 2018-2018 IEEE military communications conference (MILCOM)","author":"Yao","year":"2018"},{"key":"B43","doi-asserted-by":"publisher","first-page":"012018","DOI":"10.1088\/1742-6596\/1192\/1\/012018","article-title":"Improving adaboost-based intrusion detection system (ids) performance on cic ids 2017 dataset","volume":"1192","author":"Yulianto","year":"2019","journal-title":"J. Phys. Conf. Ser."},{"key":"B44","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1155\/2018\/1914980","article-title":"Network intrusion detection method based on pca and bayes algorithm","volume":"2018","author":"Zhang","year":"2018","journal-title":"Secur. Commun. Netw."},{"key":"B45","doi-asserted-by":"publisher","first-page":"4170","DOI":"10.3390\/electronics12194170","article-title":"A network intrusion detection model based on bilstm with multi-head attention mechanism","volume":"12","author":"Zhang","year":"2023","journal-title":"Electronics"},{"key":"B46","doi-asserted-by":"publisher","first-page":"649","DOI":"10.1109\/TSMCC.2008.923876","article-title":"Random-forests-based network intrusion detection systems","volume":"38","author":"Zhang","year":"2008","journal-title":"IEEE Trans. Syst. Man, Cybern. Part C Appl. Rev."},{"key":"B47","first-page":"1","article-title":"Anomaly-based network intrusion detection using svm","volume-title":"2019 11th international conference on wireless communications and signal processing (WCSP)","author":"Zhang","year":"2019"},{"key":"B48","doi-asserted-by":"publisher","first-page":"21404","DOI":"10.1109\/access.2023.3251354","article-title":"Hc-dttsvm: a network intrusion detection method based on decision tree twin support vector machine and hierarchical clustering","volume":"11","author":"Zou","year":"2023","journal-title":"IEEE Access"}],"container-title":["Frontiers in Communications and Networks"],"original-title":[],"link":[{"URL":"https:\/\/www.frontiersin.org\/articles\/10.3389\/frcmn.2025.1546936\/full","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,5,12]],"date-time":"2025-05-12T05:39:04Z","timestamp":1747028344000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.frontiersin.org\/articles\/10.3389\/frcmn.2025.1546936\/full"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,5,12]]},"references-count":48,"alternative-id":["10.3389\/frcmn.2025.1546936"],"URL":"https:\/\/doi.org\/10.3389\/frcmn.2025.1546936","relation":{},"ISSN":["2673-530X"],"issn-type":[{"type":"electronic","value":"2673-530X"}],"subject":[],"published":{"date-parts":[[2025,5,12]]},"article-number":"1546936"}}