MCHKAN: Semantic Multichannel Heatmap Encoding With Wavelet Kolmogorov–Arnold Networks for Malicious Network Traffic Detection

While network intrusion detection systems (NIDSs) are critical for defending against sophisticated cyber threats, modern network traffic imposes severe demands on their accuracy and efficiency. Flow statistics combine heterogeneous temporal, volumetric, and protocol attributes, motivating explicit investigation of their organization. We propose MCHKAN, a semantic‐aware intrusion detection framework that integrates multichannel heatmap (MCH) encoding with wavelet Kolmogorov–Arnold networks (WavKANs). MCHKAN reorganizes 70 flow features into a 3D (4 × 5 × 4) tensor across four semantic channels and then flattens it for classification. Experiments on CIC‐IDS‐2017–derived data cover binary anomaly detection and separate 14‐class attack categorization. The revised evaluation comprises 117 runs with three seeds and validation‐based checkpoint selection. MCHKAN(DOG) achieves binary malicious‐class F1 of 0.9924 ± 0.0002 and multiclass weighted F1 of 0.9970 ± 0.0001, above the tested non‐WavKAN neural baselines but below the tree ensembles. Dimension‐matched random‐layout controls perform similarly; therefore, the results do not establish a stable benefit attributable specifically to semantic adjacency. Multiclass macro‐F1 of 0.8270 ± 0.0079 exposes persistent rare‐class errors, while a 50‐epoch binary audit does not resolve Morlet’s all‐benign predictions at the fixed threshold. Reusing historical test sets, drawing validation splits from a resampled training pool, and relying on single‐dataset evaluation limit the generalization of the model. These findings support a qualified empirical assessment of MCHKAN rather than universal superiority or a demonstrated spatial‐neighborhood mechanism.