# HDLNIDS: Hybrid Deep-Learning-Based Network Intrusion Detection System
###### Abstract  
Attacks on networks are currently the most pressing issue confronting modern society. Network risks affect all networks, from small to large. An intrusion detection system must be present for detecting and mitigating hostile attacks inside networks. Machine Learning and Deep Learning are currently used in several sectors, particularly the security of information, to design efficient intrusion detection systems. These systems can quickly and accurately identify threats. However, because malicious threats emerge and evolve regularly, networks need an advanced security solution. Hence, building an intrusion detection system that is both effective and intelligent is one of the most cognizant research issues. There are several public datasets available for research on intrusion detection. Because of the complexity of attacks and the continually evolving detection of an attack method, publicly available intrusion databases must be updated frequently. A convolutional recurrent neural network is employed in this study to construct a deep-learning-based hybrid intrusion detection system that detects attacks over a network. To boost the efficiency of the intrusion detection system and predictability, the convolutional neural network performs the convolution to collect local features, while a deep-layered recurrent neural network extracts the features in the proposed Hybrid Deep-Learning-Based Network Intrusion Detection System (HDLNIDS). Experiments are conducted using publicly accessible benchmark CICIDS-2018 data, to determine the effectiveness of the proposed system. The findings of the research demonstrate that the proposed HDLNIDS outperforms current intrusion detection approaches with an average accuracy of 98.90% in detecting malicious attacks. intrusion detection; CICIDS-2018; deep learning; convolution neural networks; recurrent neural networks +
Footnote †: journal:  
* Intrusion detection systems based on the network [4], which examine the components of unique packets to detect harmful network traffic behavior patterns. * Server signature IDS [5], which analyzes the activity system logs of individual hosts and identifies malicious attacks and hybrid identification systems [6]. * Systems that use anomaly and signature-based intrusion detection systems have higher quality and stronger security practices. The signature detection method makes use of predetermined patterns and classifiers to better assess malicious assaults. It utilizes existing information to identify harmful threats; hence, it is named a strategy based on knowledge. The approach achieves a low false positive (FP) along with higher accuracy, but it is incapable of detecting new network attacks [7]. To discover unknown hostile threats, the anomaly detection approach employs heuristic methods. As a result, the effectiveness of this anomaly detection approach for detecting anomalies is good despite a high false-positive rate. Various businesses have adopted protocol analysis, which uses a combination of anomaly and signature-based systems, to avoid this problem [8]. According to the deployment pattern, ID systems are categorized into two main types, which are distributed and non-distributed. A distributed implementation consists of several ID subsystems connected over a vast network, whereas a non-distributed structure, such as an open-source snort, may be deployed in a specific location [9]. In modern days, current methods to detect network intrusions in industries include statistical testing and threshold computation techniques. The ID system based on statistical tests relies on numerous traffic limitations, such as packet length, the timing of packet arrival, and traffic flow volume, depending on the network traffic of the model in a predetermined amount of time. Due to the complexity of today's modern malicious attacks, it is possible that these strategies will not be effective. In replacement of these statistically based techniques, a solution that is most optimized and efficient is needed.