Temporal-Spatial Attention Network (TSAN) for DoS Attack Detection in Network Traffic

TL;DR

This paper addresses the challenge of robust DoS attack detection in network traffic by proposing the Temporal-Spatial Attention Network (TSAN), which jointly models temporal patterns and spatial packet features through a transformer-based temporal encoder and a CNN-based spatial encoder, fused via cross-attention. The approach is reinforced with multi-task learning and self-supervised pre-training to improve robustness and generalization. Evaluated on the NSL-KDD dataset, TSAN outperforms a wide range of baselines, with notable gains in accuracy and AUC-ROC, and shows favorable real-time computational efficiency. The combination of temporal-spatial fusion, auxiliary supervision, and pre-training provides a scalable, effective solution for real-world DoS detection, with clear avenues for extending to other attack types and deployment scenarios.

Abstract

Denial-of-Service (DoS) attacks remain a critical threat to network security, disrupting services and causing significant economic losses. Traditional detection methods, including statistical and rule-based models, struggle to adapt to evolving attack patterns. To address this challenge, we propose a novel Temporal-Spatial Attention Network (TSAN) architecture for detecting Denial of Service (DoS) attacks in network traffic. By leveraging both temporal and spatial features of network traffic, our approach captures complex traffic patterns and anomalies that traditional methods might miss. The TSAN model incorporates transformer-based temporal encoding, convolutional spatial encoding, and a cross-attention mechanism to fuse these complementary feature spaces. Additionally, we employ multi-task learning with auxiliary tasks to enhance the model's robustness. Experimental results on the NSL-KDD dataset demonstrate that TSAN outperforms state-of-the-art models, achieving superior accuracy, precision, recall, and F1-score while maintaining computational efficiency for real-time deployment. The proposed architecture offers an optimal balance between detection accuracy and computational overhead, making it highly suitable for real-world network security applications.

Figures (5)

• Figure 1: : DoS Attack Detection Overview. Illustration of the DoS attack detection process showing attackers targeting a network and the TSAN model analyzing traffic to produce detection results.
• Figure 2: Evolution of DoS Attack Detection Methods. Timeline showing progression from traditional machine learning (2000-2010) to deep learning (2010-2015), attention mechanisms (2015-2020), and multi-task learning (2018-present), with TSAN representing the integration of these advances.
• Figure 3: TSAN Methodology Flow Diagram. The diagram illustrates the complete methodological pipeline for DoS attack detection, beginning with the NSL-KDD dataset input, followed by comprehensive data preprocessing steps, self-supervised pre-training phase, the three-component TSAN model architecture (Temporal Encoder, Spatial Encoder, and Cross-Attention mechanism), and finally the multi-task output framework with primary DoS detection and three auxiliary tasks.
• Figure 4: Data Preprocessing Pipeline for DoS Detection. The diagram illustrates the step-by-step preprocessing approach applied to the NSL-KDD dataset, highlighting feature handling techniques, binary label transformation for DoS detection, and the sliding window methodology used to capture temporal traffic patterns.
• Figure 5: TSAN Model Architecture. The diagram details the complete structure of our proposed Temporal-Spatial Attention Network, showing the parallel processing paths for temporal and spatial inputs, their respective encoding mechanisms, the feature projection and cross-attention fusion process, and the multi-task heads for primary DoS detection and auxiliary tasks. The architecture enables effective integration of sequential traffic patterns with individual packet characteristics.