# A Novel Deep Learning Framework for Intrusion Detection Systems in Wireless Network
### The Methodology's Novelty and Contributions  
Technically, there are two contributions from this strategy to the IDS:  
The first contribution is that this strategy can be used to predict the future behavior of the wireless network to detect if there is a potential threat about to happen based on observing the IP packages' information. The idea is that the flow of IP packages can reflect the behavior of the networks as it is inherently time-dependent. Each packet in the flow has a timestamp indicating when it was transmitted or received. The order of the packets and the time intervals between them thus can provide the patterns that reflect the behavior of the network over a long period. And these patterns are distinctive in the attacks. Despite how complicated an attack is, it usually leaves a trail when occurring and is presented on the flow IP packages. By carefully exploiting these trails with modern algorithms, such as ML and DL, the system can recognize the signs of an attack before it occurs. Among the algorithms, RNN-LSTM and CNN, as mentioned, are the brightest candidates for extracting and learning the time-space relationship between features in the IP package flow, and thus, they are the most suitable for this strategy. This contribution can help the IDS to be more proactive in detecting the potential threat and having enough time to react to the attack, or in the case of false detection, due to predicting multiple steps ahead in a short moment in the future, the IDS can have time to reconsider the decision before making a final decision in the upcoming current moment. This idea is considerably new in IDS study, and the closest to it, at this moment, is in the contribution [39]. The second contribution of this strategy is its ability to deal with imbalanced data without discarding any samples or changing the base relationship between categories, such as in [50; 51; 52; 53; 54; 55; 56; 57; 58; 59; 60; 61]. The main task of IDS is to recognize the attack occurring on the wireless system; therefore, classifying the traffic behavior is the main task of IDS. However, imbalanced data significantly affect almost all the classification approaches because the class imbalance directly skews the distribution of the target class (or target category) toward the majority class (or majority category). If imbalances are too high, the model becomes overly familiar with the majority class, leading to poor generalization of the minority classes. In the regression task, the impact might be less severe mostly because the regression model focuses more on the distribution of the target class and is not overly biased toward a specific range or set of classes. Therefore, as long as the distribution of the target class remains balanced, the model can still learn the full range of potential output classes and is less likely to be completely biased toward the majority. Therefore, we let the regression part in the HRC strategy handle this instead of the classification part. As mentioned, the primary task of the regression part is to try to predict the behavior of the traffic in the near future, which is specifically \"normal\" or \"attack\", so technically, the regressor also handles classifying these two categories. Regarding the attack, we combine all the attacks into one big category and, thus, raise the number of samples considerably so that it will reduce the imbalanced effect between them and the \"normal\" category. This idea, plus the fact that regression models are less affected by the imbalanced categorical problem, will help the IDS deal with the imbalanced data more effectively. Overall, this strategy can provide a new method of handling two major problems in one approach and benefit the IDS by reducing the computational cost, the complicity, and the number of other approaches used in the system to overcome these problems. With all those reasons and knowledge, in this work, we propose a strategy called HRC for an IDS framework based on DL to improve the ability of IDS that can deal with the imbalanced dataset.