## 1 Introduction  
Network intrusion detection is a security mechanism that has been developed in recent years to dynamically monitor, prevent and defend against system intrusions. It specifically refers to collect information from several nodes of a computer network or system and analyze this information to discover whether there is an attack or a breach of security policy in the network system. Research on intrusion detection technology has been conducted worldwide since the 1980s, and it has now developed into an integral part of the network security architecture [1]. Traditional machine learning methods have been widely used in network intrusion detection systems, such as Bayesian [2, 3, 4], Support Vector Machines [5, 6, 7, 8, 9, 10], Decision Trees [11, 12, 13], Logistic Regression [14, 15, 16], etc. These methods have achieved good results. However, these methods are not suitable for massive and high-dimensional data, and cannot solve the problem of degraded classification performance due to their own sensitivity to outliers and noise. At the same time, due to the continuous development of digital technology and the increasingly diverse means of cyber-attacks, traditional machine learning methods have had difficulty in meeting the needs of users. In recent years, deep learning techniques have been widely used in natural language processing [17], image recognition [18] and other fields. These techniques have also achieved good results in the field of intrusion detection by combining low-level featuresto form a more abstract and non-linear high-level representation, and then mining the input-output relationships between data. The neural networks commonly used in the field of intrusion detection mainly include convolutional neural networks (CNN), recurrent neural networks (RNN), and deep belief networks. In the literature [19], the data traffic is converted into individual pixel points in bytes, and then the images generated from the traffic are fed into convolutional neural network for convolution, pooling and other operations, and finally the classification results are obtained. The method achieves high accuracy in binary classification and multi-classification problems. The literature [20] used the recognized KDD99 dataset to conduct experiments. During the experiments, the Long Short-Term Memory (LSTM) network was used to complete the selection of parameters and achieved more satisfactory experimental results, however, the method resulted in a high false alarm rate due to the improper selection of training parameters. The literature [21] proposed a hierarchical intrusion detection system based on spatial-temporal features, which first uses deep convolutional neural networks to learn low-level spatial features of network traffic, and then uses LSTM to obtain high-level temporal features, however, the method does not consider the problems of feature fusion and data imbalance. The literature [22] combines the features of WaveNet and Bidirectional Gated Recurrent Unit (BiGRU) for feature extraction, and proposes an intrusion detection method that fuses WaveNet and BiGRU. It can achieve better detection accuracy, although it does not consider the problem of sample imbalance. Although intrusion detection techniques have made great progress, there are also the following problems. First, with regard to feature redundancy, more feature dimensions will not only increase the training time of the model, but also reduce the detection effect of the model. The literature [23] proposed an intrusion detection method based on Principal Component Analysis (PCA) and recurrent neural networks. The principal component analysis method was used to reduce the dimensionality and noise of the data to find out the subset of principal component features containing the maximum information, and then the processed data was trained using RNN networks for classification with a high accuracy rate.