Abstract:To address issues such as high-dimensional feature redundancy, class imbalance, and protocol encryption in network intrusion detection, this study proposes a multimodal intrusion detection method integrating federated learning with an improved TCN-BiGRU. Firstly, expert-based processing, encoding processing, and time-series processing are used to preprocess three modalities of data, and multimodal features are extracted using different models. Secondly, feature learning is performed through improved federated learning, and a hybrid model combining enhanced temporal convolution, bidirectional gated recurrent units, and an attention mechanism is constructed to accurately identify multi-stage attack behavior correlations, better capture local spatial features, and extract long-range temporal dependencies. Then, pyramid dilated convolution, multiple residual connections, and multi-pooling channel attention are introduced into the temporal convolution network to extract multi-scale features and channel information. Finally, multi-period temporal attention and multi-pooling channel attention are designed to extract temporal features from different time periods and enhance channel information representation. Experimental results indicate that the proposed method achieves higher accuracy, precision, recall, and F1 score on the DataCon2020 and DataCon2021 datasets than traditional machine learning and deep learning methods, with improvements of 2.65%, 3.76%, 4.55%, and 2.99%, respectively, demonstrating significant advantages and effective detection performance.