CRNN-SA: A Network Intrusion Detection Method Based on Deep Learning

Wanxiao Liu, Jue Chen, Xihe Qiu

Abstract: Network Intrusion Detection System (IDS) is crucial in defending the target network from intrusions. However, due to information loss and insufficient feature dimensions during feature extraction, the majority of existing detection algorithms are unable to fully utilize the data present in the original network. To address the aforementioned issues, this study examines the presence of temporal and spatial characteristics in network traffic data and proposes a new intrusion detection model named CRNN-SA which combines hierarchical Convolutional Neural Network (CNN), Recurrent Neural Network (RNN) and Self-Attention. This model extracts spatial features and temporal features by using CNN and RNN, respectively, and “connects” the features extracted by CNN and RNN to obtain fusion features. In order to express useful input information better, Self-Attention is utilized to allocate distinct weights to the combined characteristics. This model can effectively extract spatial and temporal features of data by increasing the granularity of synchronized input data. To ensure the accuracy of the model, it undergoes evaluation using the UNSW-NB15 dataset. The Accuracy and F1-score of the CRNN-SA model under the binary classification are 90.4\(\%\) and 91.3\(\%\), respectively, and the metrics under the multi-class classification are 89.9\(\%\) and 77.5\(\%\), respectively. Through experiments, it has been demonstrated that the combination of feature selection and deep learning models can significantly enhance the detection capability, resulting in a substantial decrease in the false positive rate.