Dynamic Convolution Meets Continuous-Time Networks in New Intrusion Detection Model

Researchers have combined two neural network techniques into a single model designed to spot intrusions in computer networks, reporting that the hybrid approach outperformed both classical deep learning models and recent state-of-the-art methods in multi-class classification tasks. The study, published in Cluster Computing, was led by Zhen Wang and Anazida Zainal together with colleagues Cui Cui, Xue Hao, Youmin Wang and Xiaomin Lin.

According to the authors, many existing detection models share two weaknesses: they struggle to analyse complex nonlinear relationships among traffic features, and they lack a comprehensive treatment of both spatial and temporal patterns in the data. The new model was designed specifically to address these two shortcomings.

The architecture rests on two components. The first, called DCKAN, merges dynamic convolution with a Kolmogorov-Arnold network. Kolmogorov-Arnold networks are a class of neural architectures that offer strong nonlinear fitting capabilities, which the researchers leverage to model intricate relationships among network features. Dynamic convolution adds adaptivity: rather than applying a single fixed convolutional operation, the model adjusts how it extracts feature information, which the authors say improves generalisation. Within DCKAN, key features are extracted adaptively from traffic data, drawing on the strengths of both techniques.

The second component addresses time. Closed-form continuous-time neural networks, or CfCNNs, are used to analyse the temporal dimension of network traffic. The authors describe these networks as adaptable to different time scales and capable of providing a good interpretation of temporal behaviour, allowing the model to characterise how traffic patterns evolve rather than treating each observation in isolation.

By combining the two components, the researchers constructed an intrusion detection model that analyses spatio-temporal feature information: the DCKAN branch captures nonlinear relationships among features while the CfCNN branch tracks their behaviour over time. The authors position this as a way to overcome the drawbacks they identify in classical deep learning approaches to the task.

In the experiments reported in the paper, the proposed model was evaluated on multi-class intrusion detection, where traffic must be assigned not simply as benign or malicious but sorted into distinct categories of activity. The authors report that their model achieved better results than other classical deep learning models and than state-of-the-art comparison models under this setting.

As with any model reported in a single study, the findings reflect the experiments the authors conducted. Readers should interpret the reported performance advantages as the authors’ experimental results on the classification tasks they examined, rather than as independently verified performance across all network environments.

The study appears in Cluster Computing, Volume 29, as article number 904, published on 26 October 2026.

Subject of Research: A hybrid dynamic convolution and closed-form continuous-time neural network model for network intrusion detection

Article Title: Dynamic convolution assisted closed-form continuous-time neural networks for intrusion detection

Article References: Wang, Z., Zainal, A., Cui, C., Hao, X., Wang, Y., & Lin, X. (2026). Dynamic convolution assisted closed-form continuous-time neural networks for intrusion detection. Cluster Computing, 29(16), Article 904. https://doi.org/10.1007/s10586-026-06687-5

Image Credits: AI Generated

DOI: 10.1007/s10586-026-06687-5

Keywords: intrusion detection, dynamic convolution, Kolmogorov-Arnold networks, closed-form continuous-time neural networks, deep learning, network security, spatio-temporal analysis, multi-class classification, Cluster Computing, Dynamic, convolution, assisted