# Hierarchical LSTM-Based Network Intrusion Detection System Using Hybrid Classification
## 3 Proposed Algorithm
### Motivation  
Unlike existing deep neural networks (DNNs) and convolutional neural networks (CNNs), an LSTM is advantageous in generating outputs of the same shape, even when the input shapes are of various sizes [24; 25]. This is because an LSTM extends the structure of the existing recurrent neural network (RNN) that generates outputs of the same dimension for inputs of various sizes, as shown in Figure 1. This characteristic of LSTM allows NIDS to divide each packet by a fixed size and then enter each part into each cell of the LSTM, so that all packets of various sizes can be used as input to the classifier. \begin{table}
\begin{tabular}{c c c} \hline \hline
**Feature Type** & **Pros.** & **Cons.** \\ \hline Session feature & It reflects the entire properties for each session well. & Since all traffic for each session is required to create a session, a lot of storage space is required. \\ Packet feature & There is no need for an analysis process to create features. & Because of the heavy burden on storage space, the entire traffic cannot be used as a feature. \\  & & Vulnerable to bypass attacks by using some session traffic. \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Comparison of advantages and disadvantages of session and packet features. Figure 1: Dual LSTM structure is flexible in terms of the number of inputs unlike DNN in which the neural network topology is fixed according to the number of existing inputs. (**a**) LSTM structure when three inputs are given; (**b**) LSTM structure when five inputs are given. Figure 1a shows a dual LSTM structure in which three identical-sized data are entered into each cell of the LSTM first layer, the output of each cell is entered into each cell of the LSTM second layer, and finally the output of the last cell is used as a classification result for the entire input data. This classifier can freely adjust the number of inputs, so even if the number of data inputs increases to 5, as shown in Figure 1b, the classification can be performed while maintaining the same structure without any modification. An LSTM can be used for classification using the entire packet data, but no studies have analyzed the relation between packet data size and classification performance. Therefore, a verification experiment is absolutely necessary to confirm that the detection accuracy is improved by using the entire packet data as an input. In this research, the classification performance according to the length of the packet used in NIDS is analyzed. In addition, the classification performance according to the number of packets used in NIDS among the packets belonging to the session is also investigated. Figures 2 and 3 show the measurement results of the classification performance according to the number of cells used when packet data are divided into 100-byte units and used as input data for each cell. The figures indicate that the overall classification performance increases with the number of cells. This result means that the performance degradation due to the gradient vanishing problem occurs as the number of LSTM cells increases, but the performance increases due to the increase in the data used for classification overwhelms the performance degradation [26]. Therefore, all packet data must be used, unlike previous studies that used only partial packets. Figures 4 and 5 show the results of evaluating classification accuracy when all the traffic of each packet is used as the input for the LSTM using the output value used for classification. These results indicate that classification performance increases as more packets of a session are used for classification. Therefore, according to this experiment, classification performance may be improved by using as many packets as possible for the classification of a single packet. Furthermore, as many packets as possible should be used for a single session. Figure 2: Detection rate of the LSTM according to the total LSTM cell size for classifying a packet with ISCXIDS2012.