ENHANCING NETWORK SECURITY THROUGH DEEP

LEARNING: AN ANOMALY-BASED INTRUSION DETECTION

SYSTEM.

BY

ONI DAVID OLATOYOSI

(19/52HA091)

A SEMINAR REPORT SUBMITTED TO THE DEPARTMENT

OF COMPUTER SCIENCE, FACULTY OF COMMUNICATION
AND INFORMATION SCIENCES, UNIVERSITY OF ILORIN,
ILORIN.
APRIL, 2024.
 CERTIFICATION
This is to certify that this seminar report was written and submitted by ONI DAVID

OLATOYOSI (19/52HA091) to the Department of Computer Science, Faculty of

Communications and Information Sciences, University of Ilorin, Ilorin, Nigeria as part of the

requirement for the award of Bachelor degree in Computer Science.

_________________________ ________________________

Dr. Amos Bajeh DATE

(Supervisor)

_________________________ ________________________

Dr. Shakirat A. Salihu DATE

(Seminar Coordinator)
 Table of Contents
Title Page…………………………………………………………………………………………..i

Certification...……………………………………………………………………………………..ii

Approved page…..………………………………………………………………………………..iii

Table of Contents…………………………………………………………………………………iv

I. Background to the study……………………………………………………………….4

II. Statement of the problem………………………………………………………….…...8
II. Aim and Objectives of the Study……………………...……….……………………..11
III. Significance of the Study……………………...……….……………………………...13
IV. Literature Review………………...…….……………...……….……………………..13
V. Research Methodology/ Design……………………...……….…….……..…………..13
VII. References………………………………………...……….
…………………………..13
 CHAPTER ONE

INTRODUCTION

Network security is now a top priority for enterprises due to the growing complexity of cyber-
attacks. It is becoming harder to detect and stop complex attacks using conventional intrusion
detection techniques. This project explores the integration of deep learning techniques into
anomaly-based network intrusion detection, aiming to bolster the resilience of networks against
sophisticated attacks patterns. Leveraging the power of neural networks, this approach involves
the development and implementation of a comprehensive IDS capable of learning normal
network behavior and identifying deviations indicative of potential intrusions (Sharma et al,
2019) [1].

1.1 Background of the Study

Intrusion Detection Systems (IDS) play a crucial role in cybersecurity by monitoring network
traffic and system activities for potential threats and malicious behavior. Traditional signature-
based IDS techniques rely on predefined rules and patterns to detect known attacks, but they
often fail to identify novel or unknown threats effectively. Anomaly-based IDS approaches, on
the other hand, aim to detect deviations from normal behavior patterns, making them more
suitable for detecting zero-day attacks and advanced persistent threats (Morgera et al, 2014) [2].
Deep learning, a subset of machine learning inspired by the structure and functionality of the
human brain, has gained significant attention in recent years due to its remarkable performance
in various domains, including computer vision, natural language processing, and cybersecurity
[3]. Deep learning models, such as Convolutional Neural Networks (CNNs), Recurrent Neural
Networks (RNNs), and Autoencoders, have demonstrated superior capabilities in learning
complex patterns and representations from raw data, making them promising candidates for
anomaly-based intrusion detection systems.
By analyzing network traffic logs, packet headers, and other attributes, the proposed intrusion
detection system aims to distinguish between normal network behavior and anomalous activities.
Furthermore, this research seeks to address the challenges associated with traditional signature-
based intrusion detection systems, with the application of deep learning to automate the
extraction of features and patterns from raw network data ultimately enhancing detection
accuracy while minimizing false positives (Abawajy et al, 2018) [4].
Drawing upon insights from existing literature, this study seeks to explain the potential benefits,
challenges, and best practices associated with deploying an anomaly-based intrusion detection
system powered by deep learning technologies.

1.2 Statement of the Problem

In a world of rapidly advancing technology, the rampancy of cyber threats poses a significant
challenge to the integrity and confidentiality of sensitive information within networks. Due to the
inadequacy of traditional Intrusion detection techniques which often fail to detect attacks
complex attacks and diverse malware variants, there is a pressing need to adopt advanced
approaches that can provide a more adaptive defense mechanism.
The use of deep learning techniques in anomaly-based network intrusion detection holds great
potential due to its ability to automatically learn complex patterns and features from vast
amounts of data sets. The selection of appropriate deep learning architecture is key to addressing
issues related to false positives in anomaly detection. This project endeavors to pioneer a
functional Intrusion Detection System utilizing Convolutional Neural Networks (CNNs) and
Dense Neural Networks (Dense NNs).

1.3Aim and Objectives

This project aims to develop an effective network intrusion detection system capable of
identifying anomalies in a network.

The objectives are as follows:

1. Model a deep learning-based model for network intrusion detection.

2. Deploy and test the model in a real-world environment.

3. Evaluate the performance of the developed model.

1.4 Significance of Study

The proposed research on enhancing network security through a deep learning-based anomaly
detection system is poised to make a substantial contribution to the field of cybersecurity by
addressing critical challenges and advancing the state of intrusion detection. The significance of
this study is underscored by several key aspects:

1. Mitigating Complex Threats: Traditional intrusion detection systems often struggle to

identify and defend against advanced threats. By integrating deep learning techniques, which
excel in recognizing complex patterns and behaviors and attack vectors, the study aims to
enhance the detection capabilities against these sophisticated and evasive threats.

2. Eliminating False Positives: Existing intrusion detection systems suffer from a high rate of
false positives leading to strain in security and gross unreliability. By leveraging deep learning,
which excels in identifying normal network behavior from anomalies, the proposed system aims
to reduce false positives, enhancing the efficiency and accuracy of intrusion detection.

3. Real-world Applications: One of the most important objectives of the study is the practical
implementation of the proposed deep learning-based IDS in actual network environments to
ensure a beneficial impact on cybersecurity practitioners and organizations.

1.5 Scope of Study

The scope of this study is to model an anomaly-based network intrusion detection system
leveraging the functionality of deep learning algorithms. The study will focus on analyzing
network traffic data, system logs, utilizing various deep learning architectures for anomaly
detection. Preprocessing and feature engineering techniques will be employed to transform raw
data into suitable representations, and deep learning models will be trained and evaluated on
labeled datasets. Real-time monitoring capabilities will be explored, along with performance
comparison against existing IDS models. The study will address scalability, generalization,
limitations, and deployment considerations.
 CHAPTER 2

LITERATURE REVIEW

2.0 Introduction

Network Intrusion Detection Systems (NIDSs) are important tools for network system
administrators to detect various security breaches inside an organization’s network. An IDS
monitors, analyzes, and raises alarms for the network traffic entering or exiting from the network
devices of an organization. With the growing sophistication and prevalence of cyber threats, such
as malware, distributed denial of service (DDoS) attacks, and advanced persistent threats (APTs),
NIDS plays a crucial role in detecting and responding to these threats in real time [5].
NIDS gives useful insights into network activity and traffic patterns, enabling security teams to
monitor and analyze network behavior, discover potential misconfigurations, policy violations,
support forensic investigations and incident response activities [6].

2.1 Deep Learning

Deep learning is a subset of machine learning that advances Machine Learning closer to
Artificial Intelligence (AI). It deals with algorithms inspired by the structure and function of the
brain called artificial neural networks. These neural networks are capable of learning from data
in a way that mimics how humans learn, and they have revolutionized many fields, including
computer vision, natural language processing, speech recognition, and more.

Neural networks are composed of interconnected nodes (neurons) that process information and
learn from data by adjusting the strength of the connections (weights) between nodes [7]. Deep
neural networks have multiple hidden layers between the input and output layers, enabling them
to learn increasingly complex representations of data [8, 9]. Deep learning has proven to be
remarkably effective in various domains, outperforming traditional machine learning approaches
in many tasks.
The effectiveness of deep learning can be attributed to several factors, including the ability of
deep neural networks to learn hierarchical representations from raw data, the availability of large
 datasets and computational resources, and the development of advanced techniques like transfer
learning and regularization [10].

2.1.1 Types of Deep Learning Algorithms

Deep learning as a subfield of Machine Learning is mainly comprised of about five prominent
algorithm variations: Convolutional Neural Networks (CNNs), Recurrent Neural Networks
(RNNs), Generative Adversarial Networks (GANs), Ensemble Learning (EL) and Restricted
Boltzmann Machine (RBM) as shown in Fig. 2.1. In the following, we briefly discuss each type
of learning technique with the scope of their applicability to solve real-world problems.

Figure 2.1 Machine Learning Scope

1. Neural Network: A neural network is a machine learning process that uses interconnected
nodes, or neurons, in a layered structure. This structure is similar to the human brain and is a
type of deep learning process. Neural networks are divided into Supervised, Unsupervised
and Reinforced Neural Networks.

i. Supervised Neural Network: In the supervised neural network, the output of the input is
already known. The predicted output of the neural network is compared with the actual
 output. Based on the error, the parameters are changed, and then fed into the neural network
again (Mahesh, 2020) [11].
This class of neural networks are made up of about five algorithms:

Convolutional Neural Network (CNN): CNNs are a type of neural network that is
specifically designed for image recognition tasks. CNNs use a special type of layer called a
convolutional layer that is able to extract features from images. CNNs are very successful at
image recognition tasks and are used in a wide variety of applications.

Recurrent Neural Network (RNN): RNNs are a type of neural network that is able to
process chronological data. This means that RNNs can take into account the order of the data
that they are processing. RNNs are used for tasks such as machine translation and speech
recognition.

Long Short-Term Memory (LSTM): LSTMs are a type of RNN that is specifically
designed to learn long-term dependencies. This means that LSTMs can learn relationships
between data points that are far apart in time. LSTMs are used for tasks such as speech
recognition and machine translation as well.

Multilayer Perceptron (MLP): An MLP is a more complex type of neural network that
consists of multiple layers of neurons. This allows the network to learn more complex
relationships between the input and output data. MLPs are often used for tasks such as image
recognition and classification.

Perceptron: The perceptron is the simplest type of neural network. It consists of a single
layer of neurons and can only learn linear relationships between the input and output data.

ii. Unsupervised Neural Network: The neural network has no prior clue about the output the
input. The main job of the network is to categorize the data according to some similarities.
The neural network checks the correlation between various inputs and groups them (Mahesh,
2020).

Generative Adversarial Networks (GANs): These are algorithms that consist of two
competing neural networks: a generator and a discriminator. The generator creates new data
 samples, while the discriminator tries to distinguish between real and generated data. This
competition leads to the generator producing increasingly realistic data.

Restricted Boltzmann Machines (RBMs): These are probabilistic graphical models that
learn hidden layers to represent the input data. They are often used as building blocks for
more complex architectures like Deep Belief Networks.

Autoencoders: These algorithms compress the input data into a lower-dimensional

representation and then try to reconstruct the original data from that compressed version.
This process helps identify important features and remove noise from the data.

iii. Reinforced Neural Network: Reinforcement learning refers to goal-oriented algorithms,

which learn how to attain a complex objective (goal) or maximize along a particular
dimension over many steps (Mahesh, 2020).

2.2 Review of Related Works

Javaid et al [12] pioneered works in this field of study, where they proposed a deep learning-
based IDS using self-taught learning. Their model achieved high accuracy in detecting various
types of network attacks, outperforming traditional machine learning algorithms.
Yin et al, 2017 [13] made another notable contribution in developing a deep learning-based IDS
using recurrent neural networks (RNNs) for modeling network traffic sequences. Their approach
effectively captured the temporal dependencies in network data, improving attack detection rates.

Gao, S, et al, 2018 [14] proposed a deep learning framework based on convolutional neural
networks (CNNs) for anomaly detection in network traffic. It achieved superior performance
compared to traditional methods, effectively detecting previously unseen attacks.
The study addressed the limitations of traditional intrusion detection systems (IDS) in detecting
evolving cyber threats by leveraging the capabilities of deep learning. The study faced challenges
related to the interpretability of the CNN-based model. Deep learning models, particularly
CNNs, are often considered black boxes, making it challenging to interpret the decision-making
process and understand the features for anomaly detection. This flaw results into a widescale of
false positives when the model is tested.

Sabhnani et al [15] introduced a hybrid deep learning model combining convolutional and
recurrent neural networks (CNN-RNN) for anomaly detection in network traffic. It demonstrated
improved accuracy in detecting various types of network intrusions.
The study addressed the limitations of single-model approaches by combining the strengths of
CNNs for feature extraction and RNNs for sequential data processing, enhancing the model's
ability to capture temporal dependencies in network traffic.
The computational complexity of hybrid CNN-RNN models is very high, requiring significant
computational resources for training and inference. Additionally, the interpretability of the
combined model can be challenging due to the complexity of both CNN and RNN components.

Wang et al [16] proposed a deep autoencoder-based approach for anomaly detection in IoT
networks. It leveraged the reconstruction error of autoencoder models to identify anomalous
behaviors indicative of potential security threats. The study was able to address the challenges of
detecting anomalies in IoT network traffic, which may exhibit complex and heterogeneous
patterns, by leveraging the representation learning capabilities of autoencoders.
The effectiveness of autoencoder-based anomaly detection depends on the availability of
sufficient labeled training data for learning normal behavior. Moreover, autoencoder models
struggle to generalize well to unseen attack scenarios, particularly if the attacks significantly
deviate from the learned normal patterns.

Jiang et al, 2017 [17] investigated the impact of different data preprocessing techniques like One-
hot encoding on the performance of deep learning models for anomaly detection. The study
compared various feature extraction methods and data augmentation strategies. It addressed the
challenges of data preprocessing in anomaly detection by exploring techniques to enhance the
quality and diversity of input data, thereby improving model generalization.
The effectiveness of data preprocessing techniques varies depending on the specific features of
the dataset and the complexity of the underlying network traffic patterns. Additionally, some
preprocessing methods may introduce biases or distortions in the data, affecting model
performance.
In addition to these deep learning models, researchers have investigated the application of
ensemble techniques and hybrid approaches for IDS.
Tan et al, 2019 [18] proposed a Deep Belief Network (DBN) and Support Vector Machine
(SVM) ensemble model, leveraging the benefits of both deep learning and traditional machine
learning algorithms. Their approach achieved high accuracy and robustness in detecting various
types of network attacks.
However, it makes things more complicated by increasing computation costs and training
duration, given that both DBNs and SVMs are resource-intensive. It also adds complexity in
optimizing the ensemble's settings. Interpretation becomes more difficult due to the contrast
between the deep learning aspect of the DBN and the transparency of SVMs. Additionally,
there's a higher risk of overfitting, and the model's effectiveness depends heavily on the dataset's
characteristics.

It is important to note that while deep learning-based IDS systems have shown promising results,
they also face challenges such as the need for large datasets, computational complexity, and the
potential for adversarial attacks. Researchers have addressed these challenges by exploring
techniques like data augmentation, transfer learning, and adversarial training [19,20,21].
 CHAPTER THREE

RESEARCH METHODOLOGY

3.0 Introduction

This research methodology highlights the workflow followed to model an intrusion detection
system leveraging the dataset available on Kaggle, DataHub, etc. The dataset offers a
comprehensive list of data parameters, which are crucial for modelling an effective network
intrusion detection system (NIDS).

3.1 Methodology

1. Data Source and Description:

Gather and annotate datasets such as network logs, packet captures, and attack signatures from
various sources like Kaggle, GitHub, Google, and DataHub. The dataset to be utilized for the
analysis of network intrusion comprises a collection of 25,192 entries, each described by 42
attributes, the dataset was gathered from Kaggle.

These attributes are meticulously chosen to encapsulate the multifaceted aspects of network
traffic and behavior, serving as indicators for distinguishing between normal operations and
potential security threats. The data attributes are detailed as follows:

Duration: Represents the length of the connection in seconds, providing insight into the
temporal aspect of each network event. Long durations may signal extended unauthorized
activities.

Protocol Type: Denotes the protocol employed for the connection, e.g., TCP, UDP. The protocol
type is essential for understanding the nature of the traffic and its susceptibility to specific types
of attacks.

Service: Identifies the network service on the destination, such as HTTP, FTP, or SSH. Certain
services may be more prone to attacks based on their exposure and vulnerabilities.
Flag: Reflects the status of the connection, offering a glimpse into how connections are
terminated, which can hint at irregularities or malicious terminations.

Land: A binary attribute indicating whether the source and destination IP addresses and ports are
the same, aiming to identify land attacks.

Wrong_fragment: Counts the number of 'wrong' fragments in a connection, which may suggest
fragmentation-based attacks.

Urgent: Tally of packets marked urgent through the URG flag. Unusual urgency levels could
denote attempts to prioritize malicious packets.

Logged_in: A binary attribute indicating successful login attempts, critical for identifying
unauthorized access.

Num_compromised: Counts conditions indicating a compromised host, essential for assessing

the impact of an intrusion.

Num_file_creations, Num_shells, Num_access_files: Indicate the creation of files, shell

prompts, and file access operations respectively, which are scrutinized for signs of malicious
activity.

Num_outbound_cmds: Reflects the number of commands executed in outbound sessions,

typically expected to be zero, thus any deviation suggests an anomaly.

Is_host_login, Is_guest_login: Binary attributes marking logins from suspicious or guest

accounts, which might be subjected to less stringent security measures.

Count, Srv_count: Provide counts of connections to the same host or service within a short
timeframe, useful for identifying burst activity or scanning behaviors.

Same_srv_rate, Diff_srv_rate, Srv_diff_host_rate: Percentages that reflect the uniformity of

service requests and the diversity of hosts in the service requests, which can be indicators of
scanning or distributed attack patterns.

Src_bytes and Dst_bytes: Quantify the amount of data sent from source to destination and vice
versa. Anomalies in data transfer volumes can be indicative of data exfiltration or other attack
vectors.
Hot: Measures 'hot' indicators within a connection, serving as a barometer for suspicious
activities based on predefined criteria.

Num_failed_logins: The number of unsuccessful login attempts, with repeated failures

potentially signaling brute-force attempts.

Root_shell, Su_attempted, Num_root: These attributes gauge access levels obtained by the
user, with particular attention to unauthorized root access, which significantly elevates the risk of
system compromise.

Serror_rate, Srv_serror_rate, Rerror_rate, Srv_rerror_rate: These attributes express the rate

of connections that were unsuccessfully established, offering insights into network stability and
security posture.

st_host_count, Dst_host_srv_count: Count connections to the same destination IP, providing a

broader context for analyzing traffic flow and identifying potential target nodes within the
network.

Dst_host_diff_srv_rate, Dst_host_same_src_port_rate, Dst_host_srv_diff_host_rate: These

attributes offer a detailed view of the destination host's traffic, emphasizing service uniformity,
source port consistency, and error rates, which are pivotal for detecting anomalies and potential
threats.

Dst_host_count, Dst_host_srv_count: Count connections to the same destination IP, providing

a broader context for analyzing traffic flow and identifying potential target nodes within the
network.

Class: The target attribute, categorizing each entry into normal operation or specific types of
network intrusions, which serves as the foundation for the supervised learning approach adopted
in this research.

2. Data Preprocessing:

Data Cleaning: This step involves addressing missing or inconsistent data. Strategies like
imputation or exclusion of attack vectors with missing data will be considered. Other fields will
also be assessed for missing values and handled appropriately (e.g., imputing the median for
numerical fields).

Data Transformation: The transformation process will normalize numerical fields for
consistency and comparability. Categorical data like network logs and packet captures will be
transformed using techniques like Min-Max scaler, standard scaler and normalizers for data
normalization.

3. Feature Engineering: This involves analyzing and extracting relevant features from the data
based on domain knowledge. New features may be derived to enhance the model's
effectiveness. This could include calculating the time taken to process client protocol in
'duration' and ‘protocol type’.

4. Feature selection: This will be critical to the model's performance. Techniques like Principal
Component Analysis (PCA) and feature importance ranking from model outputs will be used
to identify the most relevant features. Methods like Mutual Information regression and
correlation heatmap will be used to establish the mutual relationships between columns on
the dataset.

5. Feature Encoding: Onehot encoding and Label encoding will be used to encode categorical
variables. Onehot encoding is efficient due to its ability to represent categorical variables as
binary vectors. Since the proposed model is anomaly-based, this technique will be effective
in distinguishing between a normal and abnormal network activity.

6. Model Development:

Algorithm Selection: Convolutional Neural Networks (CNNs) and Dense Neural Networks
(Dense NNs) or a hybrid combination of both will be chosen based on their performance in
similar tasks.

Training and Tuning: The data sets will be split into training, validation and testing sets for the
purpose of model training, the order of distribution is 70:15:15. Using the training set,
hyperparameters will be optimized through techniques like grid search or Bayesian optimization.
Tensor flow will be used for building the framework of the neural network.

The model will be regularized to prevent overfitting, employing techniques like dropout, L2
regularization, or early stopping.

7. Model Deployment:

Simulation of Network Traffic: A demo web application will be used to replicate the
complexity and scale of a real network environment, which will provide a controlled
environment for testing the model. Various types of network traffic will be simulated, including
normal behavior and different types of anomalies, to evaluate the model's performance.

Feature Representation: The features used by the anomaly detection model may differ between
a demo web application and a real network environment. In a web application, features might
include HTTP requests, response times, user interactions, etc. These features may not fully
represent the diversity of network traffic seen in real-world networks. Therefore, each feature on
both the web application and the model will be matched against each other in order to test how
the model performs with different types of data.

8. Model Evaluation:
Metrics: A wide range of metrics, including MAE, ROC-AUC, RMSE, Precision, Recall, and
F1-Score, will be employed to evaluate the model’s accuracy and deployment performance.

Cross-Validation: This will be used to ensure the model's generalizability and performance. It is
essential to assess the model's generalization performance and consider additional testing on
diverse datasets to ensure robustness and reliability across different scenarios.

CONCLUSION
In summary, this research delves into the potential of a deep learning-based anomaly detection
system to enhance network security. The study holds significance in mitigating advanced threats
and reducing false positives while offering real-world applicability.
Despite the complexities, the proposed research aims to contribute both theoretically and
practically to the evolving field of cybersecurity.
 REFERENCES

[1] Sharma, S., & Chen, J. (2019). A Review on Deep Learning in Intrusion Detection System.
2019 IEEE International Conference on Smart Computing and Electronic Enterprise (ICSCEE),
188–192. [Link]

[2] Butun, I., Morgera, S. D., & Sankar, R. (2014). A survey of intrusion detection systems in
wireless sensor networks. IEEE Communications Surveys & Tutorials, 16(1), 266-282.

[3] LeCun, Y., Bengio, Y., & Hinton, G. (2015). Deep learning. Nature, 521(7553), 436-444.

[4] Abawajy, J., Alazab, M., & Chowdhury, M. (2018). Deep learning-based intrusion detection
system for IoT-enabled smart environments. Future Generation Computer Systems, 89, 641–648.
[Link]

[5] Scarfone, K., & Mell, P. (2007). Guide to Intrusion Detection and Prevention Systems
(IDPS). National Institute of Standards and Technology (NIST), Special Publication 800-94.

[6] General Data Protection Regulation (GDPR). (2016). Official Journal of the European Union.

[7] Goodfellow, I., Bengio, Y., & Courville, A. (2016). Deep Learning. MIT Press.
[8] Schmidhuber, J. (2015). Deep learning in neural networks: An overview. Neural Networks,
61, 85-117.

[9] [10] LeCun, Y., Bengio, Y., & Hinton, G. (2015). Deep learning. Nature, 521(7553), 436-444.

[11] Mahesh, B. (2020). Machine learning algorithms-a review. International Journal of Science
and Research (IJSR)[Internet], 9(1), 381-386.

[12] Javaid, A., Niyaz, Q., Sun, W., & Alam, M. (2016). A deep learning approach for network
intrusion detection system. In Proceedings of the 9th EAI International Conference on Bio-
inspired Information and Communications Technologies (pp. 21-26)

[13] Yin, C., Zhu, Y., Liu, J., Fei, J., & Zhang, H. (2018). An enhanced semi-supervised
convolutional neural network intrusion detection system for 6G wireless networks. IEEE Access,
6, 39054-39063.

[14] Gao, S., Hu, J., Wang, W., Zhang, K., & Wu, X. (2018). Deep learning-based intrusion
detection system in the fog of internet of things. IEEE Access, 6, 40074-40083.

[15] Sabhnani, M., Jain, A., & Kumar, A. (2020). Hybrid deep learning architecture for intrusion
detection system. In 2020 Fourth International Conference on Inventive Communication and
Computational Technologies (ICICCT) (pp. 1373-1378). IEEE.

[16] Wang, Y., Ma, J., Sun, Y., Wang, W., & Zuo, W. (2019). Deep autoencoder based network
intrusion detection in IoT big data. IEEE Access, 7, 38412-38420.
[17] Jiang, P., Chen, Y., Huang, X., Ye, H., & Xu, Y. (2017). A hybrid deep learning architecture
for network intrusion detection. IEEE Access, 5, 26554-26565.

[18] Tan, Z., Jamdagni, A., He, X., Nanda, P., & Liu, R. P. (2019). A deep learning-based
ensemble model for intrusion detection. IEEE Access, 7, 82512-82521.

[19] Cao, Y., Gao, X., & Yang, Y. (2019). Data augmentation for enhancing deep learning-based
intrusion detection system. In Proceedings of the 2019 International Conference on Computing,
Networking and Communications (pp. 916-920)

[20] Yin, C., Zhu, Y., Liu, J., Fei, J., & Zhang, H. (2018). An enhanced semi-supervised
convolutional neural network intrusion detection system for 6G wireless networks. IEEE Access,
6, 39054-39063.

[21] Hu, S., Yu, X., Zhou, X., Chu, F. S., & Arshad, J. (2021). Adversarial learning for robust
deep learning-based intrusion detection systems. Computers & Security, 105, 102268.

[22] Yin, C., Zhu, Y., Fei, J., & He, X. (2017). A deep learning approach for intrusion detection
using recurrent neural networks. IEEE Access, 5, 21954-21961.