Feature Adaptive Distillation and Attention-Enhanced Siamese Network for Intelligent Network Intrusion Detection and Proactive Response

Abstract

To address the problems of high-dimensional feature redundancy, weak generalization ability of small- sample attacks, and insufficient detection-response coordination in network intrusion detection, this study proposes an end-to-end intelligent detection and proactive response framework based on Feature Adaptive Distillation-Attention Enhanced Siamese Network (FAD-AESN). We adopt a three-stage methodological approach: (1) a Feature Adaptive Distillation (FAD) module for adaptive dimensionality reduction, which integrates feature discriminativeness, correlation and attack relevance to dynamically adjust distillation temperature and feature weights, realizing redundant feature removal and core information preservation; (2) an Attention-Enhanced Siamese Network (AESN) module with an embedded channel-space attention mechanism and improved triplet loss function to enhance the differentiated expression of small-sample attack features; (3) a dynamic proactive response mechanism constructed based on detection confidence and multidimensional threat-level assessment, forming a closed-loop detection-response coordination system. We conduct comprehensive experiments on the CSE-CIC-IDS2018 and UNSW-NB15 datasets with 5 independent experimental runs for each algorithm; the full-sample dataset is split into training and test sets at a 7:3 ratio, and the small-sample dataset is split into support and query sets at a 6:4 ratio, with all results reported as the mean ± standard deviation. Statistical significance is verified via two-tailed t-tests (p<0.001) for all performance improvements over baseline methods. Experimental results show that FAD-AESN achieves a detection accuracy of 98.7±0.2% and a small-sample F1 score of 92.3±0.5% on the two datasets, representing improvements of 12%-18% and 3.5%-8.9% respectively compared to traditional machine learning and mainstream deep learning algorithms. The detection latency is as low as 42±3ms with a false-positive rate (FPR) of 1.2±0.1%, and the dynamic response mechanism achieves a blocking success rate of 89.3±1.2%- 98.2±0.5%. This study realizes the integrated optimization of efficient detection and dynamic response, providing an end-to-end solution for proactive network security defense, and outperforms the state-of- the-art (SOTA) network intrusion detection models of 2026 in both detection performance and real-time response capability.