SGAN-RL: Fusion classification method for network intrusion detection based on data augmentation

Abstract

Although traditional research methods for intrusion detection can effectively prevent and mitigate issues such as data leaks to avoid severe consequences, existing intrusion detection technologies encounter limitations, including low classification accuracy and high false positive rates, particularly when dealing with high-dimensional, complex network anomaly traffic data. Additionally, the common problem of class imbalance in intrusion detection datasets exacerbates these challenges. This paper introduces a novel approach to network intrusion detection classification, termed SGAN-RL, which integrates ResNet and LSTM models based on the semi-supervised generative adversarial network (SGAN) framework. This method utilizes SGAN to generate synthetic data resembling real intrusion detection data and continually trains the discriminator to produce high-quality data, thereby enhancing data distribution balance and quality. Moreover, a fusion intrusion detection classification model is presented, leveraging the strengths of ResNet and LSTM architectures to capture spatial and temporal features, respectively. This synergistic fusion enhances the model’s capacity for comprehensive data representation, resulting in improved performance in intrusion detection data classification tasks. Experiments conducted on intrusion detection datasets NSL-KDD, UNSW-NB15, and CIC-IDS2017 demonstrate that the proposed model enhances accuracy, precision, recall, F1-score, ROC-AUC, PR-AUC, respectively, showcasing its robust performance and reliability in network intrusion detection classification.

Keywords

Intrusion detection system deep learning ResNet LSTM GAN

1 Introduction

According to a report released by the China Internet Network Information Center, as of June 2023, the number of internet users in China had surpassed 1.079 billion, marking an increase of 11.09 million compared to December 2022. This figure accounts for 76.4% of the total population. With the rapid expansion of internet users, ensuring information security and privacy poses significant challenges. Early detection and prevention of network intrusions have become increasingly crucial. The concept of intrusion detection technology was initially proposed by Anderson [1]. Existing computer and data network security have been augmented by an innovative transformation method [2], operating continuously in an “open” mode.

Depending on the source of the data they acquire, intrusion detection systems can be categorized into network-based (Network Intrusion Detection System, NIDS) and host-based (Host Intrusion Detection System, HIDS) systems [3 –5]. Network-based intrusion detection systems monitor real-time network traffic, collecting packet information and scrutinizing their content to identify intrusive behavior within the network. Conversely, host-based intrusion detection systems monitor the operations or states of host systems to detect intrusion events.

Traditional machine learning methods primarily emphasize feature selection and decomposition, assessing the correlation between features to identify appropriate feature combinations. These methods demonstrate effectiveness in managing relatively small intrusion detection datasets with reasonable training speeds. For instance, classic machine learning techniques including decision trees [6], naive Bayes [7], random forests [8], support vector machines [9], and clustering [10] have been employed for network intrusion detection. However, these methods heavily depend on feature engineering and encounter challenges when confronted with datasets containing numerous features and high-dimensional data.

Deep learning, as a branch of machine learning, excels in various aspects including automatic feature learning from data, adaptation to complex data distributions, and scalability of models compared to traditional machine learning methods. Numerous researchers have applied deep neural network models such as Convolutional Neural Networks (CNNs) [11], Recurrent Neural Networks (RNNs) [12], and Long Short-Term Memory Networks (LSTMs) [13] to intrusion detection tasks. However, deep learning networks may encounter degradation in performance when the network depth reaches a certain level. Additionally, single-type neural networks struggle to simultaneously extract both temporal and spatial features.

To tackle the challenges posed by imbalanced intrusion detection datasets, gradient degradation in deep learning networks, and the inability to simultaneously consider spatial and temporal features, our approach involved utilizing data augmentation techniques to address the limitations of data scarcity and uneven data distribution. Subsequently, we employed a combination of LSTM and residual network architectures to effectively capture both spatial and temporal features in intrusion detection data while mitigating issues related to gradient degradation.

The main contributions of this paper are as follows:

We proposed a framework for intrusion detection classification method named SCAN-RL, which integrates data augmentation techniques and a fusion model of deep learning. This approach enhances the richness of samples and the representational capability of the model by combining the powerful feature extraction ability of deep learning algorithms with the sample augmentation capability of data augmentation. Consequently, it improves the accuracy and robustness of the model for intrusion detection.

We designed the Semi-supervised learning-based on Generative Adversarial Network (SCAN) for intrusion detection. By generating intrusion detection class sample data through this method and integrating it with the original dataset, the accuracy of multi-classification results of imbalanced data is enhanced. Moreover, an attention mechanism is incorporated into the model to elevate the weight of important features and reduce training time.

We developed an RL model based on ResNet and LSTM. In this design, ResNet is employed to map data forward to deep networks, maximizing information retention. Additionally, the model incorporates convolution operations and LSTM within ConvLSTM networks to extract spatial and temporal features, respectively, thereby addressing the issue of degradation in deep learning networks. Following feature extraction in the fusion model, the features are inputted into the softmax function for classification.

The efficiency of the proposed intrusion detection classification method SGAN-RL is validated using three distinct datasets: NSL-KDD, UNSW-NB15, and CIC-IDS2017. The results demonstrate that compared with traditional intrusion detection methods, the accuracy, precision, recall, F1-score, ROC-AUC, PR-AUC, and robust performance are improved and enhanced on the three datasets.

The structure of this paper is outlined as follows: Section 2 scrutinizes pertinent research concerning intrusion detection. Section 3 presents the preprocessing methods applied to network intrusion detection data. Section 4 elaborates on the proposed fusion classification method for network intrusion detection, incorporating data augmentation techniques. Section 5 outlines the comparative experiments and their corresponding evaluations. Section 6 delves into a discussion of the proposed method. Lastly, Section 7 offers conclusions drawn from the study and outlines potential avenues for future research.

2 Related work

Classic machine learning algorithms. Botha et al. [14] addressed the inefficiency of intrusion detection methods by introducing fuzzy logic and trend analysis techniques to achieve accurate detection and classification of intrusive behavior in complex network environments. Giacinto et al. [15] developed a network intrusion detection pattern recognition method by sequentially integrating multiple classifiers using a fusion strategy, allowing each classifier to contribute its strengths. Gowrison et al. [16] learned enhanced rules from network behavior to design an intrusion detection system capable of effectively classifying attacks with O(n) complexity. Vijayanand et al. [17] combined multiple support vector machine classifiers with genetic algorithms for feature selection in wireless mesh network intrusion detection, enhancing the performance and efficiency of intrusion detection. Rai et al. [6] developed an algorithm based on the C4.5 decision tree, utilizing information gain to select the most relevant features. Moreover, they chose split values in a manner that prevents the classifier from biasing towards the most frequent values. Koc et al. [7] addressed the issue of numerous and highly correlated features in network intrusion traffic using the naive Bayes method. The model appropriately relaxes the conditional assumptions to accommodate complex intrusion detection datasets. Experimental results validated the excellent overall performance of the model in terms of accuracy and false alarm rate. Negandhi et al. [8] employed the classic supervised learning algorithm random forests to detect abnormal traffic in networks and used the Gini coefficient-based importance for feature selection.

Hybrid machine learning algorithm s. In recent years, many scholars have combined multiple machine learning algorithms to complement each other, further enhancing the performance of classification models. Mulay et al. [9] combined decision trees and support vector machines to propose a tree-structured multi-class support vector machine. Experimental validation showed that this method reduces training and testing time, thereby improving system efficiency. Liu et al. [10] proposed a model that combines K-nearest neighbors and random forests, and implemented these algorithms in distributed computing on the Spark platform. Experimental results showed that this model has better accuracy for most attacks and requires less training time. Yulianto et al. [18] proposed a method based on artificial neural networks and decision trees, which consists of two stages: creating a new dataset and data classification, to design an accurate intrusion detection system with high detection rate and low false alarm rate.

Deep learning algorithms. Although the aforementioned studies have made progress in feature selection, their methods require expertise and are generally time-consuming. Aldarwbi et al. [19] proposed a novel network intrusion detection system that treats network traffic as sound and uses deep learning techniques for speech recognition to detect intrusive traffic. Riyaz et al. [20] utilized a conditional probability distribution model for analyzing the correlation coefficients between features in feature selection. They conducted classification experiments on CNNs, demonstrating the model’s excellent classification ability and significantly reduced convergence time. Chen [12] extracted spatiotemporal features from intrusion detection traffic using deep learning methods, proposing a stacked CNN and RNN network to fully extract spatiotemporal features, achieving higher accuracy. Sun et al. [13] employed a hybrid network of CNNs and LSTMs to extract features from network traffic data and utilized a category weight optimization method to enhance model robustness. Fu et al. [21] optimized the LSTM model by combining it with the LightGBM model, reducing memory consumption and data computation while requiring shorter training time. Li et al. [22] proposed a method that combines CNNs and RNNs to solve the loss function, extracting useful information from the data and ultimately finding optimal parameters.

3 Data preprocessing

In order to effectively integrate the fusion model utilized in this paper, preprocessing steps are essential for the dataset. This ensures better alignment with the model and facilitates the study of relationships within the data. The feature matrix of the original dataset before preprocessing, denoted as T₁, is represented as shown in Equation (1). $T_{1} = [\begin{matrix} a_{11} a_{12} \dots a_{1 n} y_{1} \\ a_{21} a_{22} \dots a_{2 n} y_{2} \\ \dots \dots \dots \dots \dots \\ a_{o 1} a_{o 2} \dots a_{on} y_{o} \end{matrix}]$ (1)

In the feature matrix T₁, a represents the feature vector, y represents the label vector, n denotes the number of features, and o represents the number of network traffic records. It’s important to note that different datasets may have varying numbers of features and different quantities of network traffic.

3.1 One-hot encoding

Each data point in the dataset corresponds to a network traffic record, with each record having different attribute descriptions. While the majority of features are numerical and based on either time-related traffic or host traffic, there are a few non-numerical character features present. However, in deep learning models, character features cannot be directly recognized and processed by neurons, thus necessitating their transformation into numerical features. In this paper, One-Hot encoding is selected to convert the character features and classification labels in the dataset into one-hot encoded binary vectors. In the feature matrix T₁ of the original dataset, numerical features remain unchanged, while the character feature vectors are extracted to form a new feature matrix $T_{1}^{'}$ . The extracted pure numerical feature matrix T₁ and the extracted character feature matrix $T_{1}^{'}$ are represented as shown in Equations (2) and (3). $T_{1} = [\begin{matrix} a_{11} a_{12} \dots a_{1 n - p} y_{1} \\ a_{21} a_{22} \dots a_{2 n - p} y_{2} \\ \dots \dots \dots \dots \dots \\ a_{o 1} a_{o 2} \dots a_{on - p} y_{o} \end{matrix}]$ (2) $T_{1}^{'} = [\begin{matrix} a_{1 n - p + 1} a_{1 n - p + 2} \dots a_{1 n} \\ a_{2 n - p + 1} a_{2 n - p + 2} \dots a_{2 n} \\ \dots \dots \dots \dots \dots \\ a_{on - p + 1} a_{on - p + 2} \dots a_{on} \end{matrix}]$ (3)

In the character feature matrix $T_{1}^{'}$ , p represents the number of character features. One-Hot encoding is applied to the character feature matrix $T_{1}^{'}$ , expanding each feature into dimensions corresponding to the number of categories of the respective character type, as illustrated in Equation (4). $a_{i} = (k_{1} k_{2} \dots \dots k_{α})$ (4)

A feature a_i is processed through One-Hot encoding to become a one-dimensional vector, where α represents the number of possible values for that feature. Following the rule in Equation (4), the character feature matrix $T_{1}^{'}$ is transformed into a numerical feature matrix as shown in Equation (5). $T_{1}^{'} \to T_{1}^{″} = [\begin{matrix} b_{11} b_{12} \dots b_{1 m} \\ b_{21} b_{22} \dots b_{2 m} \\ \dots \dots \dots \dots \\ b_{o 1} b_{o 2} \dots b_{om} \end{matrix}]$ (5)

After the transformation, the two numerical feature matrices T₁ and are horizontally concatenated to form a new feature matrix T₂, as shown in Equation (6). $T_{2} = T_{1} T_{1}^{″} = [\begin{matrix} a_{11} a_{12} \dots a_{1 n - p} b_{11} b_{12} \dots b_{1 m} y_{1} \\ a_{21} a_{22} \dots a_{2 n - p} b_{21} b_{22} \dots b_{2 m} y_{2} \\ \dots \dots \dots \dots \dots \dots \dots \dots \dots \\ a_{o 1} a_{o 2} \dots a_{on - p} b_{o 1} b_{o 2} \dots b_{om} y_{o} \end{matrix}]$ (6)

3.2 Remove redundant features

Following the one-hot encoding of the feature columns in the dataset, the correlation matrix is computed among numerical features, alongside the determination of Pearson correlation coefficients between specified numerical columns. This coefficient quantifies the magnitude and direction of the linear relationship between two variables, ranging from –1 to 1. A coefficient of 1 denotes a perfect positive correlation, while –1 signifies a perfect negative correlation, and 0 indicates no linear correlation.

Calculate the correlation coefficient between each feature and the label feature in the dataset.

Utilize the absolute values of these correlation coefficients to identify features exhibiting strong correlation, regardless of their positive or negative correlation. Subsequently, select features with a correlation with the label feature exceeding 0.3, considering both positive and negative correlations. This customizable threshold ensures the selection of moderately correlated features.

To gain deeper insights into features with a stronger relationship with the label, arrange these highly correlated features in descending order based on their correlation coefficient values with the label feature.

Retrieve the names (i.e., column names) of these highly correlated features.

Construct a new dataset comprising solely the selected feature names. This new dataset exclusively retains the feature columns from the original dataset that are highly correlated with the label.

At this stage, redundant features in the dataset have been entirely eliminated.

3.3 Min-max normalization

The evaluation of different features within a feature vector often involves different units of measurement, which can significantly impact the results of data processing. In intrusion detection data standardization methods, the most effective approach is min-max normalization. The purpose of min-max normalization is to confine preprocessed data within a comparable range, thereby mitigating adverse effects caused by extreme sample data. This normalization technique maps all data such that the maximum value becomes 1 and the minimum value becomes 0, while the remaining values are scaled to fall within the interval between 0 and 1. After One-Hot encoding, a feature vector a_ij in the feature matrix T₂ undergoes min-max normalization, as illustrated in Equation (7). $a_{ij}^{'} = \frac{a_{ij} - MinA}{MaxA - MinA}$ (7) $T_{3} = [\begin{matrix} a_{11}^{'} a_{12}^{'} \dots a_{1 n - p}^{'} b_{11} b_{12} \dots b_{1 m} y_{1} \\ a_{21}^{'} a_{22}^{'} \dots a_{2 n - p}^{'} b_{21} b_{22} \dots b_{2 m} y_{2} \\ \dots \dots \dots \dots \dots \dots \dots \dots \dots \\ a_{o 1}^{'} a_{o 2}^{'} \dots a_{on - p}^{'} b_{o 1} b_{o 2} \dots b_{om} y_{o} \end{matrix}]$ (8)

After min-max normalization, the original vector a_ij is replaced by the new vector $a_{ij}^{'}$ , forming a new feature matrix T₃ as shown in Equation (8). Processing the features in this manner before inputting them into the classification model can expedite gradient descent, accelerate the convergence of the training network, and improve accuracy.

3.4 Random oversampling

The distribution of sample categories in intrusion detection datasets is often imbalanced, which can have a significantly negative impact on the accuracy of classification results. An effective approach to address this issue is to perform random oversampling of the classes with fewer samples. This involves randomly selecting old samples from a smaller number of attack traffic instances multiple times, combining them with the existing samples, and then integrating them with other original data to form a new balanced dataset. $T_{3}^{'} = [\begin{matrix} c_{11} c_{12} \dots c_{1 n - p} d_{11} d_{12} \dots d_{1 m} y_{1} \\ c_{21} c_{22} \dots c_{2 n - p} d_{21} d_{22} \dots d_{2 m} y_{2} \\ \dots \dots \dots \dots \dots \dots \dots \dots \dots \\ c_{q 1} c_{q 2} \dots c_{qn - p} d_{q 1} d_{q 2} \dots d_{qm} y_{q} \end{matrix}]$ (9) $T = T_{3} T_{3}^{'} = [\begin{matrix} a_{11}^{'} a_{12}^{'} \dots a_{1 n - p}^{'} b_{11} b_{12} \dots b_{1 m} y_{1} \\ a_{21}^{'} a_{22}^{'} \dots a_{2 n - p}^{'} b_{21} b_{22} \dots b_{2 m} y_{2} \\ \dots \dots \dots \dots \dots \dots \dots \dots \dots \\ a_{o 1}^{'} a_{o 2}^{'} \dots a_{on - p}^{'} b_{o 1} b_{o 2} \dots b_{om} y_{o} \\ c_{11} c_{12} \dots c_{1 n - p} d_{11} d_{12} \dots d_{1 m} y_{o + 1} \\ c_{21} c_{22} \dots c_{2 n - p} d_{21} d_{22} \dots d_{2 m} y_{o + 2} \\ \dots \dots \dots \dots \dots \dots \dots \dots \dots \\ c_{q 1} c_{q 2} \dots c_{qn - p} d_{q 1} d_{q 2} \dots d_{qm} y_{o + q} \end{matrix}]$ (10)

In the intrusion detection feature matrix $T_{3}^{'}$ , o represents the total number of data points in the dataset. Random oversampling is perform on attack data from classes with fewer instances to generate a feature matrix $T_{3}^{'}$ , as shown in Equation (9).

In the feature matrix $T_{3}^{'}$ generated by random oversampling, q represents the number of data points generated through oversampling. The feature matrix $T_{3}^{'}$ generated by random oversampling is vertically concatenated with the original feature matrix T₃ to form the matrix T, as shown in Equation (10).

4 Methodology

This paper employs a fusion model of ResNet and LSTM (RL) for network intrusion detection classification. It leverages the ResNet network’s capability to effectively address the problem of network degradation and the LSTM’s efficiency in handling temporal features to improve the accuracy issue in network intrusion detection classification and enhance robust performance. By integrating ResNet and LSTM, both spatial and temporal features are considered, thereby improving the predictive performance of the model on intrusion detection datasets.

The overall architecture of the model is illustrated in Fig. 1. Firstly, a data preprocessing module is employed to remove redundant features, process the data as necessary to fit the model’s dimensions and data format, and perform oversampling to address imbalanced data distributions. Secondly, the preprocessed training set is fed into ResNet and LSTM models for feature extraction separately. The extracted feature matrices are then fused, and the model is continuously trained. Finally, data augmentation is performed using the self-supervised generative adversarial network (SGAN) to enhance data balance. Additionally, an attention mechanism is incorporated into the SGAN-RL model to strengthen the learning of important features, further improving the accuracy of the model’s classification.

Fig. 1

The refined network architecture diagram of model SGAN-RL.

4.1 Data augmentation method

The objective of the generator in the SGAN network used in this paper [23] remains consistent with the original GAN network, wherein it takes random noise as input and generates pseudo data realistic enough to be indistinguishable from real data. However, the discriminator in SGAN differs significantly from that of the original GAN network. Before employing the SGAN network, the preprocessing of the intrusion detection raw dataset involves utilizing the data preprocessing method proposed in Section 3 of this paper. The feature matrix T, obtained after One-Hot encoding and normalization of the intrusion detection dataset, serves as part of the input to the SGAN model discriminator.

The discriminator of the SGAN model proposed in this paper primarily receives three types of input. The first input is the pseudo samples T_F generated by the generator using random noise S, as shown in Equation (11). $T_{F} = Generater (S) = [\begin{matrix} \begin{matrix} \begin{matrix} e_{11} \\ e_{21} \\ \begin{matrix} \dots \\ e_{s 1} \end{matrix} \end{matrix} & \begin{matrix} e_{12} \\ e_{22} \\ \begin{matrix} \dots \\ e_{s 2} \end{matrix} \end{matrix} \end{matrix} & \begin{matrix} \begin{matrix} \dots & e_{1 r} \end{matrix} \\ \begin{matrix} \dots & e_{2 r} \end{matrix} \\ \begin{matrix} \begin{matrix} \dots & \dots \end{matrix} \\ \begin{matrix} \dots & e_{sr} \end{matrix} \end{matrix} \end{matrix} \end{matrix}]$ (11)

The latter two inputs are labeled real samples T from the training dataset and unlabeled real samples T₀, as shown in Equations (12) and (13). $T = [\begin{matrix} \begin{matrix} x_{11} & x_{12} \end{matrix} & \dots & \begin{matrix} x_{1 r} & y_{1} \end{matrix} \\ \begin{matrix} x_{21} & x_{22} \end{matrix} & \dots & \begin{matrix} x_{2 r} & y_{2} \end{matrix} \\ \begin{matrix} \begin{matrix} \dots \\ x_{s 1} \end{matrix} & \begin{matrix} \dots \\ x_{s 2} \end{matrix} \end{matrix} & \begin{matrix} \dots \\ \dots \end{matrix} & \begin{matrix} \begin{matrix} \dots & \dots \end{matrix} \\ \begin{matrix} x_{sr} & y_{s} \end{matrix} \end{matrix} \end{matrix}]$ (12) $T_{0} = [\begin{matrix} \begin{matrix} x_{11} \\ x_{21} \\ \begin{matrix} \dots \\ x_{s 1} \end{matrix} \end{matrix} & \begin{matrix} \begin{matrix} x_{12} \\ x_{22} \\ \begin{matrix} \dots \\ x_{s 2} \end{matrix} \end{matrix} & \begin{matrix} \dots \\ \dots \\ \begin{matrix} \dots \\ \dots \end{matrix} \end{matrix} & \begin{matrix} x_{1 r} \\ x_{2 r} \\ \begin{matrix} \dots \\ x_{sr} \end{matrix} \end{matrix} \end{matrix} \end{matrix}]$ (13)

The purpose of employing the SGAN network is to generate data with a distribution similar to that of the original data and utilize this generated data to replace the original data.

The optimization objective function of SGAN is shown in Equations (14) and (15). $\underset{G}{Min} max_{D} V (D, G)$ (14)

$\begin{matrix} V (D, G) = & E_{x_{ij} \sim p_{data} (x_{ij})} [log D (x_{ij})] \\ + E_{e \sim p_{e} (e)} [log (1 - D (G (e))) \end{matrix}$ (15)

In Equation (14), G represents the generator in the SGAN model proposed in this paper, and D represents the discriminator. In Equation (15), the discriminator D tries to increase the value of the function V, while the generator Gtries to decrease the value of the function V, and they are in mutual opposition.

4.1.1 Generator

The SGAN network utilized in this paper comprises a generator and a discriminator. The generator constructed in this study consists of three convolutional blocks. Each convolutional block comprises one ConvTranspose transpose convolutional layer, one Batch Normalization layer, one LeakyReLU activation function layer, and one Dropout layer. Following the three convolutional blocks is a fully connected layer used to control the output dimension of the generator, followed by the output. Specifically, the structure of the SGAN generator is illustrated in Fig. 1(a). The SGAN generator algorithm is depicted in Algorithm 1.

Algorithm 1: SGAN generator algorithm

Input: random noise S = (t₁, t₂, …, t_r), label vector Y = (y₁, y₂, …, y_s)

Output: T_F ={ (e₁₁, e₁₂, …, e_1r) (e_s1, e₂₂, …, e_2r) … (e_s1, e_s2, …, e_sr) }

(1) q₁ ← Dense (S, Y)

(2) for each k ∈ [1, 3] do

(3) q₁ ← Conv Transpose, BN layer, ReLU activation function, Dropout (q₁)

(4) end for

(5) T_F ← Dense (q₁)

(6) return T_F

The SGAN generator algorithm produces realistic synthetic data samples for intrusion detection through a generative model, notably augmenting the quantity of data for classes with small samples, thereby enhancing the overall accuracy of the method.

4.1.2 Discriminator

The discriminator comprises three convolutional blocks. The first convolutional block includes one Conv layer followed by an activation function layer, LeakReLU. The other two convolutional blocks consist of one Conv layer followed by a BN layer and an activation function layer, LeakReLU. In the classification output section, since the discriminator in this paper adopts the SGAN network concept to address the multi-classification problem of distinguishing real labels, it utilizes the softmax function. This function provides a probability distribution over a given number of categories. The higher the probability assigned to a specific class label, the more confident the discriminator is that the sample belongs to that class. To calculate the classification error, cross-entropy loss is employed to measure the difference between the output probabilities and the target one-hot encoded labels. Consequently, the output layer can both authenticate the input data and make classification predictions. The structural diagram of the SGAN discriminator is depicted in Fig. 1(b). The algorithm flow for the discriminator part of the intrusion detection data augmentation method based on the SGAN generative adversarial network proposed in this paper, responsible for distinguishing between mixed real data and fake data generated by the generator, is illustrated in Algorithm 2.

Algorithm 2: SGAN discriminator algorithm

Input: Generated intrusion detection pseudo samples T_F, labeled intrusion detection real dataset T, unlabeled intrusion detection real dataset T₀.

Output: R₁ = {Real, Fake}, $R_{1} = (y_{1}^{'}, y_{2}^{'}, \dots, y_{s + 1}^{'})$

(1) q₂← Conv, 64(T, T₀, T_F)

(2) for each k ∈ [1, 2] do

(3) q₂← Conv, 64*k, BN layer, LeakReLU Activation function (q₂)

(4) end for

(5) R₁, R₂← Softmax, sigmoid (q₂)

(6) return R₁, R₂

In Algorithm 2, line 1 performs pre-convolution operations on three input matrices T, T₀, T_FLines 2, 3, and 4 represent convolutional blocks with increasing channel sizes. Line 5 performs classification prediction using softmax and sigmoid functions.

The discriminator endeavors to distinguish between real and generated data. The discriminator and the generator engage in competition, driving the generator to continuously refine the generated intrusion detection data, making it increasingly closer to real intrusion detection data.

4.2 Feature extraction and fusion model

This paper proposes a ResNet-LSTM fusion model, referred to as the RL model. The model combines the advantages of ResNet and LSTM networks in model convergence and feature extraction, addressing the issues of gradient explosion in deep networks and effective feature extraction for intrusion detection data.

4.2.1 ResNet network model

This paper adopts the ResNet network [25] to address the problem of gradient explosion that arises as traditional convolutional neural networks deepen. Simultaneously, it effectively reduces the computational load of model convergence and mitigates overfitting issues. $x_{IJ} = x_{ij} + \sum_{a = 1}^{i - 1} F (x_{a}, W_{a})$ (16)

The residual structure for intrusion detection, as shown in Equation (16), where x_ij represents the feature vector in the intrusion detection dataset’s feature matrix used for feature extraction by the residual network, and x_ij is the feature of a deeper layer network, whose relationship with the shallow layer network feature x_ij can be represented by Equation (16).

The residual network part of the ResNet-LSTM model proposed in this paper is structured as shown in Table 1. The NSL-KDD dataset used in this study is transformed into a 122×1 dimensional data structure after preprocessing and One-Hot encoding. Due to the dimensionality of the data, the ResNet network section designed contains one pre-convolutional layer, each residual block contains two convolutional layers, and there are a total of six convolutional layers in three residual blocks.

Table 1

Residual network structure

Layer Names	The ResNet network in this paper
Conv1	3 × 3, 64, s = 1, p = 2
Activation function	ReLU
Conv2_x	$[\begin{matrix} 3 \times 3, & 64 \\ 3 \times 3, & 64 \end{matrix}]$
Pooling	3 × 3, max pool = 2, s = 1
Conv3_x	$[\begin{matrix} 3 \times 3, & 128 \\ 3 \times 3, & 128 \end{matrix}]$
Pooling	3 × 3, max pool = 2, s = 1
Conv4_x	$[\begin{matrix} 3 \times 3, & 192 \\ 3 \times 3, & 192 \end{matrix}]$

In the ResNet-LSTM model proposed in this paper, the residual network section consists of one pre-convolutional layer and 3 residual blocks. The structure of the residual blocks are as shown in Fig. 1(c) ResNet network. The pre-convolutional layer is followed by a Batch Normalization (BN) layer and an activation function. The first residual block includes two convolutional layers, one BN layer, and one activation function. The second and third residual blocks each contain two convolutional layers, two BN layers, two activation functions, and one pooling layer.

Algorithm 3: Feature extraction algorithm based on ResNet network

Input: Training dataset T = {(x₁₁, …, x_1r, y₁) ,

(x₂₁, …, x_2r, y₂) , …, (x_s1, …, x_sr, y_s)}, The number of samples is s, and the number of features is r.

Output: Feature set Z₁{ f₁, f₂ …… f_n }

(1) p₁← Conv1D, BN layer, ReLU activation function (T)

(2) shortcut ←p₁

(3) p₁←Conv1D, BN layer, ReLU activation function, Conv1D (p₁)

(4) p₁← add[shortcut, p₁]

(5) for each k ∈ [2, 3] do

(6) shortcut ←MaxPooling1D(p₁)

(7) p₁← Conv1D, BN layer, ReLU activation function, Dropout (p₁)

(8) p₁← add[shortcut, p₁]

(9) end for

(10) Z₁← BN layer, ReLU activation function, Flatten (p₁)

(11) return Z₁

In Algorithm 3, lines 1 and 2 define the pre-convolutional block and the residual block shortcut. Lines 3 and 4 define the first residual block. Lines 5 to 9 define the second and third residual blocks. Line 10 represents the generation of feature set Z₁.

Algorithm 3 employs the ResNet model as part of feature extraction. The algorithm incorporates batch normalization before the activation layer, which effectively enhances the convergence speed of the model.

4.2.2 LSTM network model

Compared to traditional LSTM networks, ConvLSTM [25] features more advanced memory units C_t. When feature vectors x_ijfrom the intrusion detection feature matrix Tare inputted into the memory units, the memory unit records and accumulates them for the next feature vector entry. The memory unit is also controlled by several gates for input and output. When a feature vector x_ijis inputted, the input gate is activated. If the feature vector x_ijis to be forgotten during the process, the forget gate is activated. The final state H_t received by the memory unit from the output of memory unit C_t controls the extraction of the feature vector x_ijthrough the output gate o_t. The ConvLSTM network structure employs a convolutional structure when multiplying the saved state with parameters. The learned parameters are the weights of the convolutional kernel. The internal structure of the ConvLSTM is depicted in Fig. 1(d), similar to a traditional LSTM network.

The operation rules of ConvLSTM are illustrated in Equations (17) to (21). $i_{t} = σ (W_{xi} * X_{t} + W_{hi} * H_{t - 1} + W_{ci}^{\circ} C_{t - 1} + b_{i})$ (17)

$\begin{matrix} F_{t} = σ (W_{xf} * X_{t} + W_{hf} * H_{t - 1} \\ + W_{cf} \circ C_{t - 1} + b_{f}) \end{matrix}$ (18)

$\begin{matrix} C_{t} = f_{t} \circ C_{t - 1} + i_{t} \circ tanh (W_{xc} * X_{t} \\ + W_{hc} * H_{t - 1} + b_{c}) \end{matrix}$ (19) $O_{t} = σ (W_{xo} * X_{t} + W_{ho} * H_{t - 1} + W_{co} \circ C_{t} + b_{o})$ (20) $H_{t} = o_{t} \circ tanh (C_{t})$ (21)

After the feature vectors x_ijfrom the intrusion detection dataset’s feature matrix Tundergo ConvLSTM feature extraction processing, the final state is stored in H_t. The feature extraction algorithm based on LSTM networks, primarily responsible for extracting temporal features, is outlined in Algorithm 4.

Algorithm 4: Feature extraction algorithm based on LSTM networks

Input: Training dataset T = {(x₁₁, …, x_1r, y₁) ,

(x₂₁, …, x_2r, y₂) , …, (x_s1, …, x_sr, y_s)}, The number of samples is s, and the number of features is r. Output: Feature set Z₂ ={ g₁, g₂, …, g_n }

(1) for each k∈[0,3] do

(2) p₂← Conv1D, BN layer, ReLU activation function, Dropout (T)

(3) end for

(4) 256 ← lstm_output_size

(5) p₂← ConvLSTM1D, Dropout (p₂)

(6) Z₂← BN layer, ReLU activation function, Flatten (p₂)

(7) return Z₂

In Algorithm 4, lines 1, 2, and 3 are used to construct four convolutional layers. Lines 4 and 5 are used to construct one ConvLSTM layer. Line 6 generates the feature set Z₂ through Flatten.

Algorithm 4 utilizes the ConvLSTM model to extract long-term temporal and spatiotemporal features. The model consists of three convolutional layers and one ConvLSTM1D layer, extracting multi-level features of different depths.

4.2.3 Fusion model

The preprocessed intrusion detection dataset feature matrix Tis inputted into both the ResNet model and the LSTM model for feature extraction. After feature extraction by both models, the intrusion detection feature sets Z₁ and Z₂ are obtained. These feature sets are fused into feature set H using the concatenate function, as shown in Equation (22). $H = Z_{1}, Z_{2} = {(f_{1}, g_{1}) (f_{2}, g_{2}) \dots \dots (f_{n}, g_{n})}$ (22)

The ResNet model and LSTM model mentioned in this paper independently extract features and then fuse them using the concatenate function, as shown in Algorithm 5.

Algorithm 5: Fusion Model Algorithm

Input: Features Set Z₁, Z₂

Output: model, a set containing classifications H ={(f₁, g₁) (f₂, g₂) …… (f_n, g_n)}

(1) m← concatenate(Z₁, Z₂)

(2) predictions ← Softmax(m)

(3) model ← loss(categorical_crossentropy), optimizer(adam)

(4) return model

In Algorithm 5, line 1 indicates the fusion of feature sets Z₁ and Z₂ using the concatenate function. Lines 2 and 3 are used for training the model and saving the trained model. Algorithm 5 integrates features extracted by two models for classification, effectively addressing network degradation issues while fully capturing the temporal characteristics of the data.

5 Experimental valuation

5.1 Experimental dataset

The NSL-KDD dataset [26] is a simplified version of the KDD’99 dataset. The labels of the NSL-KDD dataset include 38 types of attacks categorized into 4 anomaly types: Denial of Service (DoS), Probe, Remote-to-Local (R2L), and User-to-Root (U2R) attacks.

The UNSW-NB15 dataset [27] was created by the IXIA PerfectStorm tool at the University of New South Wales laboratory to generate a mixture of real-world network traffic and network attack behavior. This dataset contains a total of eight types of attacks: Fuzzers, Analysis, Backdoor, DoS, Exploits, Generic, Reconnaissance, and Worms. This dataset consist of 257,673 records, each with 45 features.

The CIC-IDS2017 dataset [28], developed by the Department of Computer Science at the University of New Brunswick in 2017, is captured from a real network configuration. It consists of two segments: the first containing 4 computers and the second containing 10 computers that are under attack. This dataset spans 5 days of data collection, comprising 2,830,734 instances and over 80 features.

5.2 NSL-KDD dataset experiment

Experiment on the NSL-KDD dataset involves preprocessing the raw data by feature encoding and using random oversampling and undersampling to standardize the dataset input into the RL model. The algorithms are evaluated separately for binary and multiclass classification.

(1) Binary Classification

In the binary classification experiments, the effectiveness of the RL model proposed in this paper is validated by comparing it with traditional machine learning and deep learning models, as depicted in Table 2. It is evident that the RL fusion model proposed in this paper achieves superior performance, with accuracy, precision, recall, and F1-score reaching 99.32%, 99.06%, 98.67%, and 98.78%, respectively, significantly outperforming other methods.

Table 2
Binary classification on NSL-KDD

Model Accuracy Precision Recall F1-score

Decision Tree [32] 81.05% – – –

Logisitic Regression [32] 78.32% – – –

CNN 75.21% 75.47% 75.14% 74.22%

LSTM 73.99% 73.61% 73.55% 73.65%

RL 99.32% 99.06% 98.67% 98.78%

Model	Accuracy	Precision	Recall	F1-score
Decision Tree [32]	81.05%	–	–	–
Logisitic Regression [32]	78.32%	–	–	–
CNN	75.21%	75.47%	75.14%	74.22%
LSTM	73.99%	73.61%	73.55%	73.65%
RL	99.32%	99.06%	98.67%	98.78%

(2) Multiclass Classification

In the multiclass problem, due to the small amount of data for some attack types in the dataset, the classification accuracy of this category is lower, which affects the overall classification accuracy.

From Table 3, it is evident that while other models exhibit higher accuracy in classifying majority class attacks, they encounter challenges in detecting attacks within classes with fewer samples. In contrast, the RL method proposed in this paper achieves a lowest detection rate of 96.78% for minority class attack traffic, ensuring a high level of detection. This underscores the effectiveness of the RL algorithm in accurately classifying specific attack classes in multiclass scenarios, demonstrating robustperformance.

Table 3

Each attack classification in NSL-KDD

Model	Normal	Probe	Dos	U2R	R2L
LSTM-IDM [29]	97.03%	70.33%	85.64%	8.95%	16.78%
Adaboost-SVM [31]	96.74%	70.03%	97.94%	83.87%	97.84%
ResNet	57.41%	0.4%	68.87%	99.02%	59.44%
LSTM	70.38%	78.82%	95.66%	99.02%	8%
RL	98.87%	97.56%	99.75%	96.78%	97.02%

From Table 4, comparisons were made with other contemporaneous models in the multiclass experiment. The proposed RL algorithm achieves an accuracy, precision, recall, F1-score, ROC-AUC, and PR-AUC of 99.10%, 99.09%, 99.06%, 99.01%, 99.92%, and 81.27%, respectively, for multiclass classification on the NSL-KDD dataset, significantly outperforming other papers from the same period.

Table 4

Multiclass classification on NSL-KDD

Model	Accuracy	Precision	Recall	F1-score	ROC-AUC	PR-AUC
LSTM-IDM [29]	80.32%	–	–	–	–	–
SAAE [30]	86.41%	87.35%	86.41%	86.61%	–	–
Adaboost-SVM [31]	94.32%	89.28%	87.52%	–	–	–
ResNet	97.67%	98.98%	96.75%	97.85%	98.84%	72.88%
LSTM	96.40%	96.57%	96.25%	97.30%	96.70%	64.16
RL	99.10%	9 9.09%	9 9.06%	99.01%	99.92%	81.27

Table 5 illustrates that after data augmentation, SGAN-RL outperforms the other two models, indicating superior robustness of the RL model.

Table 5

Multiclass classification on NSL-KDD (noise influence)

Model	Accuracy	Precision	Recall	F1-score	ROC-AUC	PR-AUC
SGAN-ResNet	95.87%	96.08%	95.70%	96.12%	99.31%	83.81%
SGAN-LSTM	93.05%	93.34%	92.75%	92.09%	99.29%	84.74%
SGAN-RL	9 7.30%	97.36%	97.33%	97.24%	99.65%	92.38%

5.3 UNSW-NB15 dataset experiment

(1) Binary Classification Comparative

From Table 6, the accuracy, precision, recall, and F1-score of the RL model proposed in this paper are 99.29%, 98.56%, 95.55%, and 96.49%, respectively, which surpass those of other methods.

Table 6
Binary classification on UNSW-NB15

Model Accuracy Precision Recall F1-score

ResNet 98.40% 98.24% 94.93% 96.12%

LSTM 98.04% 93.08% 91.09% 95.44%

RL 99. 29% 9 8.56% 95.55% 96.49%

Model	Accuracy	Precision	Recall	F1-score
ResNet	98.40%	98.24%	94.93%	96.12%
LSTM	98.04%	93.08%	91.09%	95.44%
RL	99. 29%	9 8.56%	95.55%	96.49%

(2) Multiclass Comparative Experiment

From Table 7, it can be observed that the RL model outperforms the other two models in multiclass classification. It achieves superior accuracy in six out of nine categories, while the accuracy in the remaining three categories is comparable.

Table 7

Each attack classification in UNSW-NB15

Model	ResNet	LSTM	RL
Normal	88.49%	80.53%	9 0.11%
Analysis	97.04%	97.51%	99.57%
Backdoor	95.41%	50.13%	98.89%
DoS	91.71%	91.47%	9 9.82%
Exploits	54.89%	54.84%	57.19%
Fuzzers	93.25%	91.77%	93.51%
Generic	84.43	66.90%	83.97%
Reconnaissance	91.93%	92.14%	90.29%
Worms	99.29%	99.51%	97.68%

From Table 8, comparisons were made with other contemporaneous models in the multiclass experiment. The proposed RL algorithm achieves an accuracy, precision, recall, F1-score, ROC-AUC, and PR-AUC of 89.95%, 89.89%, 89.86%, 89.89%, 98.76%, and 33.22%, respectively, for multiclass classification, significantly outperforming other papers from the same period.

Table 8

multiclass classification on UNSW-NB15

Model	Accuracy	Precision	Recall	F1-score	ROC-AUC	PR-AUC
ADASYN-PCA-LightGBM [32]	89.56%	–	–	–	–	–
RF-ICA [33]	86.10%	–	–	–	–	–
LSTM	86.87%	87.67%	85.68%	88.27%	97.96%	31.83%
ResNet	89.69%	89.89%	89.41%	89.84%	98.66%	27.21%
RL	89.95%	89.89%	89.86%	89.89%	98.76%	33.22%

As shown in Table 9, after adding adversarial data samples, the recall rate of ResNet decreased by 7%, and the performance of LSTM models declined by over 5% in all four aspects. In comparison, the performance of the RL model remained stable, indicating its outstanding robustness and resistance to interference.

Table 9

Multiclass classification on UNSW-NB15 (noise influence)

Model	Accuracy	Precision	Recall	F1-score	ROC-AUC	PR-AUC
SGAN-ResNet	86.05%	89.95%	80.71%	87.08%	98.45%	60.42%
SGAN-LSTM	81.64%	82.50%	80.16%	76.66%	96.26%	35.34%
SGAN-RL	88.18%	88.29%	88.01%	88.78%	98.78%	42.96%

5.4 CIC-IDS2017 dataset experiment

(1) Binary Classification Comparative

From Table 10, the accuracy, precision, recall and F1-score of the RL fusion model proposed in this paper are 99.79%, 99.47%, 99.69% and 98.57%, respectively, which are higher compared to other methods.

Table 10
Binary classification on CIC-IDS2017

Model Accuracy Precision Recall F1-score

ResNet 87.80% 90.46% 78.99% 80.32%

LSTM 97.89% 97.08% 97.83% 97.08%

RL 99.79% 99.47% 99.69% 98.57%

Model	Accuracy	Precision	Recall	F1-score
ResNet	87.80%	90.46%	78.99%	80.32%
LSTM	97.89%	97.08%	97.83%	97.08%
RL	99.79%	99.47%	99.69%	98.57%

(2) Multiclass Comparative Experiment

From Table 11, it is evident that the RL model exhibits higher classification accuracy in 14 out of 15 categories, suggesting its superiority over the other two models in multi-class classification tasks.

Table 11

Each attack classification on CIC-IDS2017

Model	ResNet	LSTM	RL
Normal	98.58%	98.88%	99.72%
FTP-Patator	0.4%	78.82%	97.56%
SSH-Patator	68.87%	95.66%	99.75%
DOS sloworis	99.02%	99.02%	96.78%
DOS Slowhttptest	59.44%	8%	97.02%
DOS GoldenEye	99.72%	98.23%	99.87%
Heartbleed	99.71%	99.20%	99.82%
DOS Hulk	99.42%	99.01%	100%
SQL Injection	98.68%	98.45%	99.18%
XSS	98.64%	99.51%	100%
Brute Force	98.38%	99.54%	99.72%
Infiltration	99.54%	99.65%	99.68%
Bot	97.31%	98.41%	99.18%
DDoS	99.03%	96.15%	99.41%
PortScan	98.83%	99.13%	99.76%

From Table 12, comparisons were made with other contemporaneous models in the context of multi-class classification. The proposed RL algorithm achieves an accuracy, precision, F1-score, ROC-AUC, and PR-AUC of 93.84%, 94.58%, 93.14%, 99.64%, and 84.68%, respectively, for multiclass classification, significantly outperforming other models.

Table 12

Multiclass classification on CIC-IDS2017

Model	Accuracy	Precision	Recall	F1-score	ROC-AUC	PR-AUC
Adaboost-PCA-SMOTE [34]	81.47%	85.15%	94.92%	–	–	–
RF-Adaboost [35]	91.73%	85.78%	91.73%	–	–	–
ResNet	80.63%	89.93%	69.77%	82.51%	98.06%	71.81%
LSTM	85.61%	91.08%	75.93%	82.82%	98.22%	75.56%
RL	9 3.84%	94.5 8%	92.92%	93.14%	99.64%	84.68%

As shown in Table 13, the three models were combined with adversarial generative networks and subjected to comparative experiments on the CIC-IDS2017 dataset. The RL model exhibited superior experimental results in terms of accuracy, precision, recall, and F1 score, indicating its enhanced robustness and stronger resistance to interference.

Table 13

Multiclass classification on CIC-IDS2017(noise influence)

Model	Accuracy	Precision	Recall	F1-score	ROC-AUC	PR-AUC
SGAN-ResNet	83.97%	90.96%	66.58%	82.05%	98.10%	68.91%
SGAN-LSTM	83.23%	83.34%	70.71%	80.16%	98.90%	82.38%
SGAN-RL	89.28%	92.50%	85.31%	88.45%	99.63%	84.56%

6 Discussion

Through comparative experiments on the NSL-KDD dataset, it is observed that the proposed deep learning RL fusion algorithm significantly improves the accuracy, precision, and recall of intrusion detection data classification compared to classical machine learning classification algorithms such as decision trees, Logistic regression, etc. This is because deep learning networks inherently possess better feature extraction, data fitting, and classification prediction capabilities compared to shallow models, thus providing more accurate intrusion detection classification results.

Furthermore, the comparative experiments show that the deep learning RL fusion algorithm outperforms single-structure deep learning models such as CNN, LSTM, etc., with an increase of over 24%, 26%, and 25% in accuracy, precision, and recall, respectively, in binary classification, and also have improvements in multi-classification scenarios. This superiority is attributed to the RL fusion model combining the advantages of ResNet and LSTM. Specifically, ResNet residual networks transmit information from shallow layers through direct mappings and residual blocks, addressing overfitting and the vanishing gradient problem in deep networks. Additionally, the RL fusion model employs LSTM to extract time-related features from intrusion detection data, which, combined with spatial features extracted by residual networks, resolves the challenge of handling spatial-temporal dual features in datasets, thus enhancing overall intrusion detection accuracy.

The comparison experiments on three datasets using SGAN models have demonstrated that RL models exhibit better classification robustness and resistance to interference. For instance, in a multi-classification scenario, utilizing SGAN-based data augmentation techniques, RL models show an improvement in F1 score compared to other deep learning algorithms. This enhancement can be attributed to the RL model’s superior feature extraction capability built upon data augmentation. Additionally, attention mechanisms have been integrated into the classification model to amplify the importance of specific features, thereby further enhancing the accuracy of classification results for categories with fewer samples.

However, there is still room for improvement in the research on network intrusion detection. Although the algorithm’s robustness has been validated on three different datasets, there are still some limitations, especially given the increasingly diverse trends in attack types in the current network environment. Therefore, to enhance network security, there is an urgent need to utilize the latest, more comprehensive, and detailed datasets to train and evaluate models for predicting network attacks, ensuring that the models can accurately identify and classify different types of attack behaviors. By training on such datasets, we can better understand and address the various threats in the current network environment, effectively safeguarding the security of networks and systems. Additionally, as this method involves multiple sub-models with numerous parameters, the model training in this study was optimized through manual parameter adjustment, resulting in low training efficiency. Automated parameter tuning will be studied in the future to improve the effectiveness of model training.

7 Conclusion and future work

This paper addresses the current issues in the field of intrusion detection by proposing a data augmentation method based on SGAN semi-supervised generative adversarial networks. This data augmentation model comprising a generator and a discriminator is established, where preprocessed raw data and randomly generated noise are inputted into the generator together. The generated fake data and real data are then inputted into the discriminator for discrimination, engaging in continuous adversarial training. This process results in the generation of high-quality data of the same type, thereby achieving sample expansion and data augmentation. Additionally, we design a network intrusion detection RL model by combining ResNet and LSTM. With ResNet, information is transmitted from shallow layers through direct mappings and residual blocks, effectively addressing the overfitting issues encountered during intrusion detection experiments. LSTM is used to extract both time and spatial features from intrusion detection data for improving overall intrusion detection accuracy. As a result, significant improvements in accuracy, with the highest increase of 18.78%, are observed in multi-classification intrusion detection problems. Furthermore, the proposed fusion model with data augmentation also significantly enhances precision and recall rates, with the highest precision increase of 6.54% and recall increase of 18.73%. This approach is particularly useful for addressing attacks with minimal sample sizes but high intrusion risks.

For future work, our focus will be on enhancing the detection capabilities against the dynamic and varied attack methods observed in real-world network environments. We plan to explore fine-tuning paradigms using pre-trained models to expand the detection scope, thereby further improving model robustness. Additionally, we aim to implement automated hyperparameter tuning during model training to intelligently optimize the model and enhance its effectiveness. These efforts will contribute to the continued advancement of intrusion detection systems, ensuring their adaptability and reliability in complex network environments.

Footnotes

Acknowledgments

This work was supported by National Natural Science Foundation of China (no.62376240), S& T Program of Hebei (nos.226Z0701G, 236Z0702G, 236Z0304G), the Natural Science Foundation of Hebei Province (nos. F2022203026, F2022203089), Science Research Project of Hebei Education Department (no. BJK2022029) and Innovation Capability Improvement Plan Project of Hebei Province (no. 22567637H). The authors are grateful to the valuable comments and suggestions of the reviewers.

References

Anderson

J.P.

, Computer security threat monitoring and surveillance, in Technical Report, James P. Anderson Company, 1980.

Mukherjee

, Heberlein

L.T.

and Levitt

K.N.

, Network intrusion detection, in IEEE Network 8(3) (1994), 26–41.

Soniya

S.S.

and Vigila

S.M.C.

, Intrusion detection system: Classification and techniques, in Proc. Circuit, Power and Computing Technologies (ICCPCT), 2016 International Conference on. 2016. IEEE.

Chawla

, Lee

, Fallon

and Jacob

, Host based intrusion detection system with combined CNN/RNN model, in Proc. ECML PKDD 2018 Workshops. Cham: Springer International Publishing, 2019:149–158.

Rebecca

, An introduction to intrusion detection & assessment, in Proc. International Conference on Software Architecture(ICSA), 1998:89–96.

Rai

, Devi

M.S.

and Guleria

, Decision tree based algorithm for intrusion detection, International Journal of Advanced Networking and Applications 7(4) (2016), 28.

Koc

, Mazzuchi

T.A.

and Sarkani

, A network intrusion detection system based on a hidden Naïve bayes multiclass classifier, Expert Systems with Applications 39(18) (2012), 13492–13500.

Negandhi

, Trivedi

and Mangrulkar

, Intrusion detection system using random forest on the NSL-KDD dataset, Emerging Research in Computing, Information, Communication and Applications: ERCICA 2018, Volume 2. Springer Singapore, 2019:519–531.

Mulay

S.A.

, Devale

P.R.

and Garje

G.V.

, Intrusion detection system using support vector machine and decision tree, International Journal of Computer Applications 3(3) (2010), 40–43.

10.

Liu

, Gu

and Wang

, A hybrid intrusion detection system based on scalable K-means plus random forest and deep learning, IEEE Access 9 (2021), 75729–75740.

11.

Riyaz

and Ganapathy

, A deep learning approach for effective intrusion detection in wireless networks using CNN, Soft Computing 24 (2020), 17265–17278.

12.

Chen

, Network intrusion detection method based on deep learning[J], Telecommunications Engineering Technology and Standardization 35(08) (2022), 88–92.

13.

Sun

, Liu

, Li

, et al, DL-IDS: Extracting features using CNN-LSTM hybrid network for intrusion detection system, Security and Communication Networks 2020 (2020), 1–11.

14.

Botha

and Solms

R.V.

, Utilising fuzzy logic and trend analysis for effective intrusion detection, Computers & Security 22(5) (2003), 423–434.

15.

Giacinto

, Roli

and Didaci

, Fusion of multiple classifiers for intrusion detection in computer networks, Pattern Recognition Letters 24(12) (2003), 1795–1803.

16.

Gowrison

, Ramar

and Muneeswaran

, et al, Minimal complexity attack classification intrusion detection system, Applied Soft Computing 13(2) (2013), 921–927.

17.

Vijayanand

, Devaraj

and Kannapiran

, Intrusion detection system for wireless mesh network using multiple support vector machine classifiers with genetic-algorithm-based feature selection, Computers & Security 77 (2018), 304–314.

18.

Esmaily

, Moradinezhad

and Ghasemi

, Intrusion detection system based on Multi-Layer Perceptron Neural Networks and Decision Tree, 2015 7th Conference on Information and Knowledge Technology (IKT), Urmia, Iran, 2015, pp. 1–5.

19.

Aldarwbi

M.Y.

, Lashkari

A.H.

and Ghorbani

A.A.

, The sound of intrusion: A novel network intrusion detection system, Computers and Electrical Engineering 104 (2022), 108455.

20.

Riyaz

and Ganapathy.

, A deep learning approach for effective intrusion detection in wireless networks using CNN, Soft Computing 24 (2020), 17265–17278.

21.

Z.C.

and Liu

J.H.

, Network intrusion detection system based on deep learning, Network Security Technology and Application 265(01) (2023), 4–7.

22.

, Fu

, Zhao

S.L.

, et al. Remote detection method for network intrusion in smart campus based on CNN-GRU, Modern Electronic Technology 45(23) (2022), 93–96.

23.

Chavdarova

and Fleuret

, SGAN: An alternative training of generative adversarial networks, the institute of electrical and electronics engineers, Inc. (IEEE) Conference Proceedings, 01/2018:9407–9422.

24.

Shi

, Chen

, Wang

, et al, Convolutional LSTM network: A machine learning approach for precipitation nowcasting, Advances in Neural Information Processing Systems 2015:802–810.

25.

Kaiming

, Zhang

, Ren

and Sun

, Deep residual learning for image recognition, in Proc.2016 IEEE Conference on Computer Vision and Pattern Recognition (CVPR), IEEE, 2016:770–778.

26.

Protić

D.D.

, Review of KDD Cup ‘99, NSL-KDD and Kyoto +Datasets[J], Vojnotehnički Glasnik/Military Technical Courier 66(3) (2018), 580–596.

27.

Moustafa

and Slay

, UNSW-NB15: a comprehensive data set for network intrusion detection systems (UNSW-NB15 network data set), in Proc. 2015 Military Communications and Information Systems Conference (MilCIS). IEEE, 2015:1–6.

28.

Rosay

, Cheval

, Carlier

, et al, Network intrusion detection: A comprehensive analysis of CIC-IDS[C], in Proc. 8th International Conference on Information Systems Security and Privacy. SCITEPRESS-Science and Technology Publications, 2022:25–36.

29.

Ding.

Y.L.

, Design and implementation of intrusion detection system based on long short-term memory model, Nanjing: Southeast University, 2019.

30.

Tang

C.F.

, Research and implementation of network intrusion detection algorithm based on LightGBM and autoencoder, Urumqi: Xinjiang University, 2021.

31.

Bian Yuchan

Y.C.

, Research on network intrusion detection method based on SVM and Adaboost, Shenyang: Shenyang University of Technology, 2022.

32.

F.J.

, Research on network intrusion detection system based on LightGBM, Xi’an: Xidian University, 2020.

33.

Kang

, Wang

and Li

Z.X.

, An intrusion detection model based on multiple feature extraction strategies in the Internet of Thing, Information Network Security 2019(09) (2019), 21–25.

34.

Yulianto

, Sukarno

and Suwastika

N.A.

, Improving Adaboost-based intrusion detection system (IDS) performance on CIC IDS dataset, Journal of Physics: Conference Series, IOP Publishing, 1192(1) (2019), 012018.

35.

Alrowaily

, Alenezi

and Lu

, Effectiveness of machine learning based intrusion detection systems, Security, Privacy, and Anonymity in Computation, Communication, and Storage, Atlanta, USA, 2019, pp. 277–288.