PSAF-Net: a position-aware sparse encoding and structure-aware fusion network for open-set network intrusion detection

Abstract In cybersecurity, intrusion detection systems face growing challenges due to increasingly heterogeneous attack patterns and evolving behaviors, particularly in the recognition of unknown threats. Existing approaches show limited generalization and unstable decision boundaries due to insufficient modeling of structural divergence, distributional shift, inadequate responsiveness to abrupt local anomalies, and weak multi-scale feature fusion capabilities. To address these issues, we propose a position-aware sparse encoding and structure-aware fusion network (PSAF-Net). Specifically, PSAF-Net incorporates a learnable position-aware encoding module to embed temporal positional cues, improving the modeling of heterogeneous communication structures and behavioral trends. It then introduces a sparsity-enhanced encoding module guided by local variation rates, using sliding-window-based attention to highlight abrupt changes and suppress redundant activations, thereby improving sensitivity to fine-grained anomalies. Finally, a temporal structure-aware feature modeling module is designed to dynamically integrate multi-receptive-field features through a scale-aware guided attention feature fusion mechanism and a cross-scale structure-aware gated fusion, strengthening the model’s capacity to discriminate under diverse attack modes and shifting distributions. Extensive experiments on CIC-IDS2017, UNSW-NB15, and ToN-IoT datasets demonstrate that PSAF-Net significantly outperforms state-of-the-art methods in unknown threat detection, exhibiting superior detection accuracy and open-set generalization.