## 2 Research Method
### Proposed the ResInceptNet-SA Model Structure  
The core of the network intrusion detection model was ResIncepNet-SA, which consisted of the ResNet module, InceptionNet module, SA module, and a detection layer for classifying network attacks, as shown in Figure 2. The residual structure reduced model complexity, enhanced feature extraction efficiency, and improved overall performance [41]. Instead of the traditional multilayer CNN structure, the Inception structure extracted features in the traffic data at different scales by connecting three CNN cores of various sizes in parallel, enhancing the model's ability to recognize complex patterns. The SA module further improved the model's ability to capture key features. The SA module further enhanced the model's ability to capture important features. By leveraging self-attention, it more effectively identified and strengthened key regions, which improved detection performance in complex network traffic data. The detection layer integrated the features extracted by the previous modules to produce the final classification output. The residual block consisted of a residual part and direct mapping. The direct mapping preserved the original data, preventing over-simplification of features during residual module fusion. Given the input feature map \(X_{i}\), the residual part is \(F(X_{i},W_{i})\), with \(W_{i}\) representing the convolution operation set. This allowed each layer of the network to effectively learn the original traffic features, improving the classification accuracy for malicious traffic. The residual block is shown in Figure 3, and the direct mapping formula is as follows:  
\[D(x)=w^{\prime}*x \tag{1}\]  
where \(D(\cdot)\) denotes a \(1\times 1\) convolution operation that reduces the dimensionality of the input feature map to match the output dimension of the residual part. The final output of the residual block is  
\[X_{i+1}=\lambda_{rule}(D(X_{i})+F(X_{i},W_{i})) \tag{2}\]  
where \(\lambda_{rule}\) denotes the activation function RELU, which is used to improve the nonlinear representation of the network. The problem of network learning difficulty can be solved by direct mapping \(D(X_{i})\). The residual part \(F(X_{i},W_{i})\) of the model is replaced by Inception, and the direct mapping uses 1\(\times\)1 convolutional layers to add and subtract dimensions to the original feature maps so that the outputs are the same dimensionality as the outputs of the residual paths. The Inception_1 unit consisted of four branches: one with seven convolutional kernels and another with a max pooling layer. These branches used different sizes of convolutional and pooling kernels, enabling the unit to capture multiscale features and enhancing the model's ability to adapt to changes in the size and characteristics of input data. This multi-branch structure allowed the model to process features at various scales simultaneously, which improved its overall performance in handling diverse input variations. The structure of this unit is illustrated in Figure 4, and the detailed parameters are provided in Table 1.  
Figure 2: ResInceptNet-SA model. The Inception_2 unit consisted of two convolutional layers with identical kernel sizes, as detailed in Table 2. This design created a parallel branch structure, allowing the model to capture diverse feature information at the same scale. By using identical kernels in both branches, the unit ensured that feature extraction was consistent across different parts of the input, while still allowing the model to learn from multiple feature maps. This parallel structure enabled the model to process features in different ways while maintaining a