MRLA: A Multi-Scale Time-Frequency Representation Learning Model with Lightweight Attention for Network Traffic Anomaly Detection

As cyberattacks grow increasingly diverse and sophisticated, achieving accurate yet efficient network traffic anomaly detection has become a fundamental challenge in modern cybersecurity. While existing machine learning methods enable effective feature extraction, they remain limited in jointly modeling multi-scale temporal dynamics and frequency-domain characteristics of anomalous network behaviors, and typically incur substantial computational overhead when processing long traffic sequences. These limitations hinder their effectiveness in real large-scale deployments. To overcome these challenges, this paper proposes a Multi-scale time-frequency Representation learning and Lightweight Attention (MRLA)-based model, which unifies hierarchical time and frequency feature learning with efficient long-range dependency modeling. Extensive experiments on the CIC-IDS2018, CIC-DDoS2019, and UNSW-NB15 datasets with session-aware data splits demonstrate that MRLA achieves F1-scores of 99.94%, 99.78%, and 93.74%, respectively. These results indicate that MRLA consistently delivers high detection accuracy with improved computational efficiency, offering a robust and scalable solution for network traffic anomaly detection across diverse attacks.