DMR-HDM: Data Augmentation Method Based on Dual-Modal Representation and Hierarchical Diffusion Model for Network Intrusion Detection

Network intrusion detection is critically constrained by data imbalance, where minority attack classes suffer from insufficient training samples. Existing data augmentation methods typically focus on single-modal representations, failing to leverage complementary information in dual-modal network traffic data. Moreover, real-world class imbalance prevents advanced multi-modal fusion architectures from achieving their full potential. To address these challenges, this paper proposes Dual-Modal Representation and Hierarchical Diffusion Model (DMR-HDM), a framework that systematically generates synchronized dual-modal traffic data. In this framework, we establish a dual-modal representation where Network Flow Features and Network Traffic Images are extracted from each network flow with strict one-to-one correspondence. The hierarchical diffusion architecture decomposes generation into two specialized layers: Network Flow Features DDPM (NFF-DDPM) generates network flow features conditioned on traffic categories to establish global semantic constraints, while Improved Feature-Conditional DDPM (IFC-DDPM) generates network traffic images conditioned on first-layer features to preserve local structural details. To enhance generation quality, we implement Adaptive Feature Fusion that dynamically adjusts conditioning strength across diffusion timesteps, and Progressive Condition Injection that provides layer-specific conditioning across network hierarchical levels. Extensive experiments on CIC-IDS-2017 and TFC-2016 datasets demonstrate superior performance, with DMR-HDM achieving 0.9982 accuracy on TFC-2016 and 0.9876 on CIC-IDS-2017. Compared with state-of-the-art methods, DMR-HDM improves F1-score by 4.32%–11.15% over recent CSV-based diffusion approaches and up to 3.07% over single-modal image methods, with improvements up to 26.10% for particularly challenging minority classes.