Abstract
Network Intrusion Detection Systems (NIDSs) are deployed and constitute an essential component of modern network defense against adversaries employing more and more advanced cyberattack strategies. Nevertheless, maintaining high detection accuracy in heterogeneous network environments still faces great challenges because of the diversity of traffic patterns and attack behaviors. This paper proposes a new Spatial–Contextual Dual-Feature Fusion (SCDF-CNN-BiGRU) framework in the context of hierarchical network intrusion detection employing multiple benchmark cybersecurity datasets. The proposed framework utilizes a lightweight shared convolutional neural network (CNN) feature extraction stage followed by 2 parallel and complimentary learning branches. The first branch employs Bidirectional Gated Recurrent Unit (BiGRU) to extract temporal dependencies and contextual relationships of network traffic while the second one adopts bidirectional convolutional processing to learn discriminative spatial representations. The features extracted from both branches are then fused via feature aggregation module to create an overall traffic representation. It also establishes hierarchical intrusion analysis through binary attack detection and multi-class attack categorization, along with an attack-level mapping strategy to connect different levels of attack types and the corresponding highly representative fine-grained attack descriptions. The framework was evaluated using six heterogeneous benchmark datasets, including UNSW-NB15, NSL-KDD, NF-ToN-IoT-v3, CICIOT2023, BCCC and CIC-UNSW-NB15. Experimental results showed strong detection performance with binary classification accuracies of up to 0.999 and multi-class accuracies of up to 0.988. These findings indicate that the proposed SCDF-CNN-BiGRU framework gives robust representations and consistent performance across multiple heterogeneous datasets via unified learning and ensemble inference.