1 Introduction↩︎

As network infrastructure and cyber threats evolve, better intrusion detection systems are required to recognise complex attack patterns. Traditional signature-based detection systems are successful for known threats, but not for zero-day exploits or dynamic threat environments. Machine learning is a promising tool for detecting novel attack vectors using pattern recognition and anomaly detection [1].

NIDS encounter multiple obstacles, including high-dimensional feature spaces, temporal dependencies in network traffic, class imbalance between normal and malicious operations, and real-time processing. Deep learning, specifically Long Short-Term Memory (LSTM) networks, have demonstrated promising results in modelling sequential data and capturing long-term dependencies in network traffic patterns [2], [3].

Topological Data Analysis (TDA) is a sophisticated mathematical framework for analysing complex dataset shapes and structures [4]. TDA, unlike standard statistical approaches, captures the underlying geometric structure and multiscale relationships through persistent homology. This results in feature representations that are robust even under noise and disturbances [5]. Topological characteristics’ stability makes them ideal for security applications where adversaries use obfuscation and evasion strategies to hide illicit activity.

This study highlights that network intrusion patterns have both structural and temporal aspects. Different attack types result in unique topological signatures in the feature space. Denial-of-Service assaults create dense connection patterns, whereas port scanning results in sparse, systematic exploration topologies. To avoid detection, attackers may spread their operations across numerous time frames. This requires models that can capture long-range sequential relationships.

This study suggests a hybrid architecture that uses a multi-layer perceptron (MLP) fusion network to combine LSTM-based temporal modelling with topological data acquired from TDA. The following issues are addressed by the suggested strategy:

1. Topological Feature Extraction: We calculate Betti curves that describe the connectedness and loop patterns of network traffic point clouds using persistent homology, producing features that are resilient to noise and stay invariant under continuous deformation.

2. Temporal Modelling: The LSTM component captures temporal dependencies that static classifiers are unable to model by processing sequential network information inside sliding time periods.

3. Feature Fusion: The model can simultaneously utilise structural and sequential information by combining topological and temporal feature representations through a concatenation-based fusion network.

The CIC-IDS2017 dataset [6], a modern benchmark with over 2.8 million labelled network flows with 77 network features and 14 different attack categories covering contemporary threat families like DDoS, brute force, web attacks, infiltration, and botnets, is used to assess the suggested framework. We show the efficacy of combining topological and temporal information for network intrusion detection through comprehensive experiments that include ablation tests, 5-fold cross-validation, and statistical significance assessment.

This paper’s main contributions are: (1) a novel hybrid TDA+LSTM architecture for network intrusion detection; (2) a mathematical formulation of Betti curve extraction and fusion with deep temporal models; (3) a thorough experimental evaluation that includes ablation analysis on a contemporary benchmark dataset; and (4) an in-depth examination of how topological features enhance temporal representations across various attack categories.

2 Literature Review↩︎

2.1 Machine Learning in Network Security↩︎

Signature-based systems that compared incoming traffic to databases of recognised attack patterns were the foundation of early network intrusion detection techniques [7]. Although these techniques work well for known threats, they are essentially unable to identify zero-day assaults or previously undiscovered attack variations, which is why machine learning techniques are being used.

Among the earliest machine learning techniques used for network intrusion detection were Support Vector Machines (SVMs), which demonstrated efficient binary categorisation of network traffic through ideal hyperplane separation [8], [9]. Due to their ensemble-based robustness and capacity to manage the high-dimensional, heterogeneous feature spaces typical of network data, Random Forest classifiers soon became well-known [10], [11]. Nevertheless, these approaches handle each network flow separately and are unable to simulate how attack campaigns change over time.

2.2 Deep Learning Approaches↩︎

Deep learning has substantially advanced the state of the art in network intrusion detection by enabling automatic feature learning from raw data [1], [12]. Recent comprehensive surveys [13], [14] highlight the rapid evolution of deep learning approaches for anomaly-based intrusion detection. Convolutional Neural Networks (CNNs) have been applied to network traffic by treating packet sequences as structured inputs, learning hierarchical spatial features that capture local patterns in traffic data [15]. Autoencoder-based approaches learn representations of normal traffic behavior and detect anomalies as deviations from the learned distribution, demonstrating effectiveness for unsupervised anomaly detection [16]. Machine learning approaches have also improved traditional web attack detection methods [17].

Because of their capacity to represent sequential dependencies, recurrent neural networks (RNNs), and in particular Long Short-Term Memory (LSTM) networks, have demonstrated exceptional efficacy for network intrusion detection [2], [3]. Long-range temporal dependencies in network traffic sequences can be captured thanks to the gating mechanism in LSTMs, which solves the vanishing gradient issue present in conventional RNNs. For sequence modelling applications, Gated Recurrent Units (GRUs), first presented by Cho et al. [18], provide a computationally effective substitute with equivalent performance.

2.3 Topological Data Analysis in Security↩︎

By examining the geometry and structure of large datasets, topological data analysis has become a potent tool. In [19], the mathematical underpinnings of computational topology are established. A crucial element of TDA, persistent homology offers reliable data topology descriptors that hold steady in the face of noise and disturbances [4]. While effective techniques for persistent homology computation have been devised [20], persistence pictures provide a robust vector representation for machine learning integration [21]. Although it is relatively new, the use of TDA in cybersecurity has a lot of potential.

Umeda [22] laid the groundwork for temporal topological analysis by demonstrating the efficacy of TDA for time series classification. Using topological characteristics to describe the structure of harmful code, TDA has been investigated for malware analysis in a number of research [23]. While Clough et al.[24] created topological loss functions for deep learning, Rieck et al.[25] suggested neural persistence as a complexity metric for deep neural networks using algebraic topology. TDA-based network traffic analysis has concentrated on leveraging topological signatures to find anomalous patterns [26]. Nevertheless, there is still much to learn about integrating TDA with deep learning for network intrusion detection.

2.4 CIC-IDS2017 Dataset↩︎

The Canadian Institute for Cybersecurity at the University of New Brunswick created the CIC-IDS2017 dataset, which has become a top standard for assessing contemporary intrusion detection systems [6]. Generated from realistic network traffic over a five-day capture period, the dataset contains over 2.8 million labeled bidirectional network flows characterized by 78 features extracted using CICFlowMeter (77 used after removing the label column). The dataset encompasses benign traffic alongside 14 distinct attack categories spanning seven major threat families: Brute Force (FTP-Patator, SSH-Patator), DoS/DDoS (Slowloris, Slowhttptest, Hulk, GoldenEye), Web Attacks (XSS, SQL Injection, Brute Force), Infiltration, Botnet, and PortScan.

Previous studies on CIC-IDS2017 have achieved varying levels of success using different machine learning approaches. Traditional methods typically achieve accuracy rates between 85–92%, while deep learning approaches have demonstrated improvements, with some studies reporting accuracy rates exceeding 98% [27]. Ring et al.[28] provide a comprehensive survey of network-based intrusion detection datasets, establishing CIC-IDS2017 as significantly more representative of contemporary network environments compared to older benchmarks such as NSL-KDD.

3 Methodology↩︎

3.1 Problem Formulation↩︎

Let \(X = \{x_1, x_2, ..., x_n\}\) represent a dataset of network connection records, where each \(x_i \in \mathbb{R}^d\) is a \(d\)-dimensional feature vector (with \(d = 77\) for the CIC-IDS2017 dataset after preprocessing). The goal is to learn a function \(f: \mathbb{R}^d \rightarrow \{0, 1\}\) that maps input features to binary labels, where 0 represents normal traffic and 1 represents anomalous (attack) traffic.

Our hybrid approach combines topological features \(\phi_{TDA}(X)\) with temporal features \(\phi_{LSTM}(X)\) to create an enhanced feature representation:

\[\phi_{hybrid}(X) = \text{MLP}_{fusion}\left[\phi_{TDA}(X) \oplus \phi_{LSTM}(X)\right]\]

where \(\oplus\) denotes feature concatenation and \(\text{MLP}_{fusion}\) is a learned fusion network that combines the complementary feature representations.

3.2 Topological Data Analysis Component↩︎

3.2.1 Persistent Homology↩︎

For a given point cloud \(X \subset \mathbb{R}^d\), we construct a filtration of simplicial complexes using the Vietoris-Rips construction. For radius parameter \(r \geq 0\), the Vietoris-Rips complex \(VR(X,r)\) is defined as:

\[VR(X,r) = \{\sigma \subseteq X : \max_{x,y \in \sigma} d(x,y) \leq r\}\]

where \(d(\cdot,\cdot)\) denotes the Euclidean distance function.

The persistent homology of this filtration captures topological features that persist across multiple scales. For each dimension \(k\), we obtain persistence diagrams \(PD_k\) consisting of birth-death pairs \((b_i, d_i)\) representing the birth and death of \(k\)-dimensional homological features.

3.2.2 Betti Curves↩︎

Betti curves provide a functional representation of topological features. For dimension \(k\), the \(k\)-th Betti curve is defined as:

\[\beta_k(r) = \text{rank}(H_k(VR(X,r)))\]

where \(H_k(\cdot)\) denotes the \(k\)-th homology group. We discretize Betti curves over a range of radius values \(r \in [r_{min}, r_{max}]\) to obtain feature vectors:

\[BC_k = [\beta_k(r_1), \beta_k(r_2), ..., \beta_k(r_m)]\]

3.2.3 Time Window Construction↩︎

To capture temporal patterns, we construct overlapping time windows from the sequential network data. Given a sequence of network connections \(\{x_1, x_2, ..., x_n\}\), we create windows of size \(w\) with step size \(s\):

\[W_i = \{x_{(i-1)s+1}, x_{(i-1)s+2}, ..., x_{(i-1)s+w}\}\]

Each window \(W_i\) is then processed through the TDA pipeline to extract topological features.

3.3 LSTM Component↩︎

The LSTM component processes sequential data to capture temporal dependencies. The LSTM cell state update equations are:

\[\begin{align} f_t &= \sigma(W_f \cdot [h_{t-1}, x_t] + b_f) \\ i_t &= \sigma(W_i \cdot [h_{t-1}, x_t] + b_i) \\ \tilde{C}_t &= \tanh(W_C \cdot [h_{t-1}, x_t] + b_C) \\ C_t &= f_t * C_{t-1} + i_t * \tilde{C}_t \\ o_t &= \sigma(W_o \cdot [h_{t-1}, x_t] + b_o) \\ h_t &= o_t * \tanh(C_t) \end{align}\]

where \(\sigma\) denotes the sigmoid function, \(W_*\) are weight matrices, \(b_*\) are bias vectors, and \(*\) denotes element-wise multiplication.

3.4 Hybrid Architecture Integration↩︎

The hybrid model integrates TDA-derived features with LSTM-processed temporal features through a multi-layer perceptron (MLP) fusion network:

\[\begin{align} z_{TDA} &= \text{MLP}_{TDA}(BC_0 \oplus BC_1) \\ z_{LSTM} &= \text{LSTM}(X) \\ z_{fused} &= \text{MLP}_{fusion}([z_{TDA}; z_{LSTM}]) \\ \hat{y} &= \text{softmax}(W_{out} z_{fused} + b_{out}) \end{align}\]

where \(\oplus\) denotes concatenation, \([\cdot; \cdot]\) denotes vertical concatenation, and \(\hat{y}\) represents the predicted class probabilities.

4 Model Architecture↩︎

4.1 Overall Architecture Design↩︎

Our hybrid architecture consists of three main components: the TDA feature extraction module, the LSTM temporal modeling module, and the fusion network. Figure 1 illustrates the complete system architecture.

4.2 TDA Feature Extraction Module↩︎

The TDA module processes time windows of network data through the following stages:

1. Point Cloud Construction: Each time window is treated as a point cloud in high-dimensional space

2. Distance Matrix Computation: Pairwise distances between points are calculated using Euclidean metric

3. Persistent Homology Calculation: Vietoris-Rips filtration is applied to compute persistence diagrams

4. Betti Curve Generation: Persistence diagrams are converted to Betti curves for dimensions 0 and 1

5. Feature Vectorization: Betti curves are discretized to create fixed-length feature vectors

4.3 LSTM Temporal Module↩︎

The LSTM module consists of:

• Input layer: Accepts normalized network features

• LSTM layers: Two stacked LSTM layers with 64 and 32 hidden units respectively

• Dropout layers: Applied after each LSTM layer with dropout rate 0.2

• Dense layer: Fully connected layer for feature transformation

4.4 Fusion Network↩︎

The fusion network combines features from both modules:

• Concatenation layer: Merges TDA and LSTM features

• Dense layers: Two fully connected layers with ReLU activation

• Batch normalization: Applied after each dense layer

• Output layer: Softmax activation for binary classification

5 Tools and Techniques↩︎

5.1 Software Framework↩︎

Several specialised libraries and frameworks are used in our implementation:

• Python 3.14: The primary programming language

• PyTorch: A deep learning framework for implementing LSTM

• Scikit-learn: Baseline algorithms and machine learning tools

• Ripser: A library for effective persistent homology computation

• NumPy/Pandas: Numerical calculations and data manipulation

• Matplotlib/Seaborn: Plotting and visualisation

5.2 Data Preprocessing↩︎

The preprocessing pipeline for the CIC-IDS2017 dataset consists of:

1. Data Loading: Examining labelled CSV files obtained from PCAP that cover five days of network capture

2. Data Cleaning: Eliminating duplicate data and infinite and NaN values that result from zero-division in flow statistics

3. Feature Selection: Retaining 78 bidirectional flow features extracted using CICFlowMeter, such as packet length statistics, flow duration, flag counts, and inter-arrival periods

4. Normalisation: Scaling all numerical features using Min-Max

5. Label Encoding: Binary encoding of benign versus attack categories

6. Stratified Subsampling: To control the computational cost of TDA while maintaining class distributions, proportionate sampling of each attack category

7. Time Window Creation: Building overlapping temporal analysis windows

5.3 Topological Computation↩︎

The following methodology is used to perform TDA computations:

• Distance Computation: Euclidean distance matrices for point clouds

• Filtration Construction: Vietoris-Rips complex with adaptive radius selection

• Persistence Calculation: Calculating 0-dimensional and 1-dimensional persistence

• Betti Curve Discretisation: 200-point discretisation for uniform feature length

5.4 Training Strategy↩︎

The hybrid model training employs:

• Loss Function: Cross-entropy loss with inverse-frequency class weighting

• Optimizer: Adam optimizer [29] with learning rate 0.001

• Regularization: Dropout [30] with rate 0.2, batch normalization [31]

• Activation: ReLU activations [32] in hidden layers

• Batch Size: 32 samples per batch

• Epochs: 50 training epochs with early stopping

• Validation Split: 20% of training data for validation

6 Results and Analysis↩︎

6.1 Experimental Setup↩︎

Our experiments were conducted on the CIC-IDS2017 dataset with the following configuration:

• Total flows: 2,830,743 (Benign: 2,273,097, Attack: 557,646)

• Stratified subsample for TDA: 50,000 flows (preserving original class ratios)

• Training/test split: 80%/20% stratified random split

• Number of features: 78 bidirectional flow features

• Time window size: 50 samples

• Window step size: 25 samples

6.2 Performance Metrics↩︎

We evaluate our models using standard classification metrics:

\[\begin{align} \text{Accuracy} &= \frac{TP + TN}{TP + TN + FP + FN} \\ \text{Precision} &= \frac{TP}{TP + FP} \\ \text{Recall} &= \frac{TP}{TP + FN} \\ \text{F1-Score} &= \frac{2 \times \text{Precision} \times \text{Recall}}{\text{Precision} + \text{Recall}} \end{align}\]

where TP, TN, FP, and FN represent true positives, true negatives, false positives, and false negatives, respectively.

6.3 Comparative Results↩︎

We compare our hybrid approach against several baselines including Isolation Forest [33], which uses random partitioning to isolate anomalies:

Table ¿tbl:tab:results? presents the performance comparison of different approaches:

6.4 Training Convergence Analysis↩︎

Figure 2 shows the training and validation loss curves for our hybrid model:

The model demonstrates stable convergence with minimal overfitting, achieving validation accuracy of 100.0% by epoch 10 and maintaining consistent performance thereafter.

7 Classification Analysis↩︎

7.1 Attack Type Classification↩︎

Our hybrid approach demonstrates varying effectiveness across different attack categories. Table ¿tbl:tab:attack95types? shows the detailed classification performance:

7.2 Confusion Matrix Analysis↩︎

Figure 3’s confusion matrix offers comprehensive information about classification performance:

With adequate window representation, the model achieves flawless categorisation across all attack categories. Although these results should be viewed cautiously due to the small sample sizes, categories with fewer test windows (Brute Force: 6, Bot/Infiltration: 1) show that the model can generalise even with limited test samples.

7.3 Feature Importance Analysis↩︎

The performance of the model is greatly influenced by topological properties. Different characteristics of network traffic patterns are captured by the Betti curves for various dimensions:

• 0-dimensional features: Record cluster formations and connection patterns

• 1-dimensional features: Recognise cyclical behaviours and loop structures

• Temporal features: Time-based patterns and sequential dependencies

8 Visual Results↩︎

8.1 ROC Curve Comparison↩︎

The ROC curves for each evaluated model are shown in Figure 4:

The TDA+LSTM hybrid model effectively distinguishes between benign and anomalous traffic on the CIC-IDS2017 dataset, achieving competitive AUC performance among all evaluated models.

8.2 Persistence Diagrams↩︎

Figure 5 shows representative persistence diagrams for normal and attack traffic:

Attack traffic exhibits distinct topological signatures with more persistent features, particularly in higher dimensions.

8.3 Betti Curves Visualization↩︎

Figure 6 illustrates the Betti curves for different traffic types:

The curves reveal distinct topological patterns that enable effective discrimination between normal and malicious activities.

8.4 Topological Signatures by Attack Type↩︎

Figure 7 compares the topological signatures across different attack categories, revealing how each attack type creates distinct patterns in the Betti curve space.

8.5 Feature Branch Contribution↩︎

Figure 8 illustrates the contribution of TDA and LSTM branches during training, alongside the ablation study results.

9 Comparison↩︎

9.1 Computational Complexity↩︎

Table ¿tbl:tab:complexity? compares the computational requirements of different approaches:

Figure 9 presents the computational scaling analysis across different dataset sizes.

9.2 Scalability Analysis↩︎

Our hybrid approach demonstrates good scalability characteristics:

• Linear scaling: TDA computations scale approximately linearly with window size

• Parallel processing: Persistence calculations can be parallelized across windows

• Memory efficiency: Betti curve representations provide compact feature encoding

• Real-time capability: Processing time allows for near real-time intrusion detection

9.3 Baseline Comparison↩︎

Compared to traditional machine learning approaches:

• Feature Engineering: Automated topological feature extraction vs. manual feature selection

• Robustness: TDA features are stable under noise and perturbations

• Interpretability: Topological features provide geometric insights into attack patterns

• Generalization: Better performance on unseen attack types

10 Detailed Experimental Analysis↩︎

10.1 TDA Feature Extraction Pipeline↩︎

The complete TDA pipeline is illustrated in Figure 10, showing the transformation from raw network traffic windows to topological feature vectors.

10.2 LSTM Architecture Details↩︎

Figure 11 presents the detailed LSTM architecture with layer specifications and mathematical formulations.

10.3 Hyperparameter Configuration↩︎

Table ¿tbl:tab:hyperparameters? provides the complete hyperparameter configuration used in the experiments.

10.4 Feature Importance↩︎

Table ¿tbl:tab:feature95importance? summarizes the relative importance of different feature types in the hybrid model.

10.5 Statistical Significance↩︎

Table ¿tbl:tab:statistical95tests? reports the results of McNemar’s statistical significance testing between the hybrid model and baselines.

10.6 Error Analysis↩︎

Figure 12 provides a detailed error analysis showing the distribution of misclassifications across attack categories.

10.7 Cross-Validation↩︎

To evaluate the robustness of our approach, we perform 5-fold cross-validation. Table ¿tbl:tab:cross95validation? presents the results across all folds.

10.8 Ablation Study↩︎

To isolate the contributions of each component, we evaluate three configurations: TDA-only (MLP classifier on Betti curves), LSTM-only, and the full hybrid model. Table ¿tbl:tab:ablation? reports the results.

11 Discussion↩︎

11.1 Key Findings↩︎

Our experimental results demonstrate several important findings:

1. Synergistic Effects: The combination of TDA and LSTM features provides competitive performance compared to individual approaches. The ablation study (Table ¿tbl:tab:ablation?) demonstrates that the hybrid model consistently achieves the strongest overall metrics on CIC-IDS2017.

2. Topological Signatures: Different attack types exhibit distinct topological patterns that can be effectively captured through persistent homology and Betti curves.

3. Temporal Dependencies: In addition to the structural insights offered by TDA, LSTM networks effectively model sequential interactions in network traffic.

4. Class Imbalance Handling: When compared to conventional techniques, the hybrid approach performs better on minority attack classes.

11.2 Limitations↩︎

It is important to recognise a few limitations:

• Computational Overhead: TDA computations significantly increase computational costs, especially for large-scale installations

• Parameter Sensitivity: The method necessitates careful adjustment of filtering settings and window sizes

• Dataset Specificity: Results are based on CIC-IDS2017; more validation is needed before generalising to other modern datasets, such as CICIoT2023 and UNSW-NB15

• Real-time Constraints: In high-speed network contexts, processing latency may restrict applicability

11.3 Practical Implications↩︎

For network security applications, the suggested hybrid architecture has the following useful benefits:

• Enhanced Detection: A better capacity to identify complex assault patterns

• Reduced False Positives: Improved differentiation between normal and anomalous traffic

• Adaptability: The ability to identify new attack types through topological analysis

• Interpretability: Topological characteristics shed light on the composition and actions of attacks

12 Conclusion↩︎

In order to detect network intrusions, this research offers a novel hybrid method that combines LSTM networks and topological data analysis. Our approach achieves competitive performance on the CIC-IDS2017 dataset, a contemporary benchmark reflecting current network threat environments, by utilising the complimentary strengths of topological feature extraction and temporal sequence modelling.

Important contributions consist of:

1. Innovative Architecture: A hybrid TDA+LSTM framework for anomaly detection that integrates temporal and topological features via a learnt fusion network.

2. Mathematical Framework: Strict specification of topological feature extraction, such as Betti curves and persistence diagrams, for network security applications.

3. Experimental Validation: A thorough assessment of CIC-IDS2017 that includes statistical significance testing across contemporary attack categories, ablation experiments, and 5-fold cross-validation.

4. Comparative Analysis: A thorough comparison with baseline techniques that shows competitive detection performance with the added advantage of topological interpretability.

The hybrid model demonstrated robustness across several attack categories and achieved good AUC and F1-score performance, which validates the efficacy of our strategy. The ablation investigation demonstrates that topological and temporal variables offer complimentary information, and the combined model achieves the best overall performance. While LSTM networks successfully model temporal dependencies, the incorporation of topological invariants yields interpretable feature representations that capture the inherent structure of network traffic patterns.

Future research will concentrate on:

• Computational efficiency optimisation for real-time deployment

• Extension to multi-class classification for fine-grained attack type detection

• Assessment using different datasets to confirm generalisability

• Examining topological properties in greater dimensions

• Creation of systems for adaptive parameter selection

Our research opens up new possibilities for sophisticated cybersecurity applications by establishing a new paradigm for network intrusion detection that blends the learning power of deep neural networks with the mathematical rigour of topological data analysis.

13 Acknowledgment↩︎

The authors express their gratitude to the anonymous reviewers for their insightful comments and recommendations. We also thank the University of New Brunswick’s Canadian Institute for Cybersecurity for contributing the CIC-IDS2017 dataset, which serves as a common baseline for intrusion detection studies. The third author’s research is funded by the ANRF (SERB) research project TAR/2023/000197.

14 Mathematical Foundations↩︎

14.1 Topological Invariants↩︎

The persistent homology computation relies on the fundamental theorem of persistent homology. For a filtration \(\emptyset = K_0 \subseteq K_1 \subseteq \cdots \subseteq K_m\), the persistent \(k\)-th homology groups are:

\[H_k^{i,j} = \text{Image}(H_k(K_i) \rightarrow H_k(K_j))\]

The persistence of a homological feature born at \(K_i\) and dying at \(K_j\) is defined as \(j - i\).

14.2 Stability Theorem↩︎

The stability of persistent homology ensures robustness to noise. For two point clouds \(X\) and \(Y\) with Hausdorff distance \(d_H(X,Y) \leq \epsilon\), the bottleneck distance between their persistence diagrams satisfies:

\[d_B(PD(X), PD(Y)) \leq \epsilon\]

This theoretical guarantee underpins the reliability of our topological features.

15 Implementation Details↩︎

15.1 Algorithmic Complexity↩︎

The computational complexity of our approach consists of:

• TDA computation: \(O(n^3)\) for \(n\) points per window

• LSTM forward pass: \(O(TH^2)\) for sequence length \(T\) and hidden size \(H\)

• Fusion network: \(O(F \cdot H_{fusion})\) for feature dimension \(F\)

15.2 Memory Optimization↩︎

To reduce memory footprint, we employ:

• Sparse matrix representations for distance computations

• Gradient checkpointing for LSTM backpropagation

• Mini-batch processing for large-scale datasets

References↩︎