# A Novel Deep Learning Framework for Intrusion Detection Systems in Wireless Network
## 3 Proposed Strategy
### The Classifier  
Anomalous data traffic is directed to the classifier upon detection. The classification model then determines the attack type in each packet and reports the forthcoming attack to operators or the intrusion prevention system to manage the threat. Sufficient time is thus available to prepare the protocols to strike the attack when it occurs and prevent any harm to the system. The classifier must determine the correct type of attack to assist subsequent processes in managing the threat effectively; otherwise, further systems will deploy the wrong protocols and waste time in selecting others. A CNN1D model is one of the most reasonable choices for this task due to its high accuracy and good performance. The classifier is trained to predict only four categories of attack, excluding normal traffic and normal behavior, which is handled by the Conv1D-LSTM model. Since the sequence model is less affected by unbalanced data than the classification model, it is a good method for avoiding the bias in the classifier caused by the overwhelming quantity of normal traffic data. The results of testing and a more specific explanation of this process are given in the next section.  
The mechanism of the Conv1D in the CNN1D model is similar to the Conv1D layer in the Conv1D-LSTM in terms of its method of calculating the convolution and the applied activation function. The only difference is not using the padding for the data at each layer's input so the model can down-sample the data quickly to retrieve only the most important features. Since its primary task is classifying the input packet data according to the best matching attack of four attack types, the input will be the features \(\left(x_{1}^{(t+s)}x_{2}^{(t+s)}x_{3}^{(t+s)},\ldots,x_{n}^{(t+s)}\right)\) of each IP packet \(X^{(t+s)}\) in the sequence \(F_{future_{dat}}\). Hence,  
Figure 9: The threshold.  
the output is the category that corresponds to the input feature and is determined by the softmax activation function, given by  
\[P^{(t+s)}=P\Big{(}X^{(t+s)}\Big{)}=\frac{e^{X^{(t+s)}}}{\sum_{j}^{J}e^{X^{(t+s)} }}, \tag{20}\]  
where \(J\) is the number of categories (or we can say as classes) that are the attack types.  
The predicted type of attack will be the type that has the largest \(P^{(t+s)}\):  
\[\widehat{Y^{(t+s)}}=argmax\Big{(}P^{(t+s)}_{j}\Big{)},\ \ \ \ j=0,1,2,\ldots,J. \tag{21}\]  
For classification purposes, the categorical loss will be used to measure performance, which is presented by  
\[L\Big{(}\widehat{Y^{(t+s)}},Y^{(t+s)}\Big{)}=-\frac{1}{S}\sum_{s=1}^{S}\sum_{j =0}^{J}Y^{(t+s)}_{j}.log\Big{(}P^{(t+s)}_{j}\Big{)}. \tag{22}\]  
The model optimizes this loss during the training process until it reaches the minimum value.  
After all processes, the output of the classifier, which is the system's output, is a vector of predicted attack types:  
\[\widehat{Y_{future}}=\Big{(}\widehat{Y^{(t+s)}}\Big{)}=\Big{(}\widehat{Y^{(t)} },\widehat{Y^{(t+1)}},\widehat{Y^{(t+2)}},\ldots,\widehat{Y^{(t+S)}}\Big{)}, \ \ \ \ s=0,1,2,3,\ldots,S. \tag{23}\]  
We selected the following parameters for our CNN1D model, which are demonstrated in Figure 10:  
Figure 11 shows the model's training results in terms of loss and accuracy. The model reached the highest accuracy score very quickly.  
Figure 10: Conv1D structure for the classifier.  
The change in dimensions of the traffic data through the entire strategy is illustrated in Figure 12.