Network　intrusion　detection　system　plays　a　crucial　role　in　protecting　the　integrity　and　availability　of　sensitive　assets,　where　the　detected　traffic　data　contain　a　large　amount　of　time,　space,　and　statistical　information.　However,　existing　research　lacks　the　utilization　of　spatial-temporal　multi-granularity　data　features　and　the　mutual　support　among　different　data　features,　thus　making　it　difficult　to　specifically　and　accurately　identify　anomalies.　Considering　the　distinctions　among　different　granularities,　we　propose　a　framework　called　tri-broad　learning　system　(TBLS),　which　can　learn　and　integrate　the　three　granular　features.　To　explore　the　spatial-temporal　connotation　of　the　traffic　information　accurately,　a　feature　dataset　containing　three　granularities　is　constructed　according　to　the　characteristics　of　time,　space,　and　data　content.　In　this　way,　we　use　broad　learning　basic　units　to　extract　abstract　features　of　different　granularities　and　then　express　these　features　in　different　feature　spaces　to　enhance　them　separately.　We　use　a　normal　distribution　initialization　method　in　BLS　to　optimize　the　weights　of　feature　nodes　and　enhancement　nodes　for　better　detection　accuracy.　The　merits　of　our　proposed　model　are　exhibited　on　the　UNSW-NB15,　CIC-IDS-2017,　CIC-DDoS-2019,　and　mixed　traffic　datasets.　Experimental　results　show　that　TBLS　outperforms　the　typical　BLS　in　terms　of　various　evaluation　metrics　and　time　consumption.　Compared　with　other　machine　learning　methods,　TBLS　achieves　better　performance　metrics.　©　2023,　The　Author(s),　under　exclusive　licence　to　Springer　Science+Business　Media,　LLC,　part　of　Springer　Nature.