# A Novel Deep Learning Framework for Intrusion Detection Systems in Wireless Network
## 3 Proposed Strategy
### The Detector  
The detector is the most important component of this strategy. It is used to detect whether the traffic flow input at the current time and at the future time is normal or anomalous. If the traffic is an anomaly, the classification component is triggered and information about the flow is passed to the classification model to identify the attack type and apply cautious policy programming. If traffic flow is normal, these actions will not be triggered. The model should detect traffic correctly; otherwise, potentially harmful attacks may be missed, or normal traffic may be considered with incorrect caution. It must also predict whether an attack is probable within the next few intervals and not mislead with an alarm for the wrong type of traffic behavior. We used Conv1D-LSTM in this part of the strategy. Almost every type of neural network uses the gradient descent method to adjust its weights and biases to fit the training problem. This method requires forward and backward propagation. In order to forward propagation, we denote the \(F^{(t)}\) as the input sample, which is the sample of IP package features, at time \(t\), of the past \(t-b\) samples, and \(B\) is just an index for indicating how \(b\) changes. We also indicate \(w\) as the kernel convolution, which contains the kernel elements \(w_{\pm m}\), which are the weights that will be learned during the training process; these kernels have the size of \(2m+1\)  elements for \(m=0,1,2,\dots\). The \(w_{m=0}\) is the kernel's center element, \(w_{-m}\) is the kernel's element that is \(m\) input samples away from the left side of the center kernel's element, and \(w_{m}\) is the kernel's element that is \(m\) input samples away from the right side of the center kernel's element. We also indicate \(\beta\) is the bias; \(conv1D\) represents the 1D convolution operation with zero-padding, and the dimension of the feature map at the Conv1D layer output is, therefore, equal to the input. Based on (2), if we denote the asterisk \(*\) as the convolution operation, the calculation mechanism of the Conv1D layer performed on each input in the sequence \(F_{past}\) then can be illustrated in Figure 4:  
Figure 3: The illustration of our proposed strategy. \[conv1D\Big{(}F^{(t-b)},w,\beta\Big{)}=X^{(t-b)}\ *w+\beta=\sum_{j=-m}^{m} \left(F^{[(t-b)+j]}\.w_{j}\right)+\beta,\ \ \ \ b=(0,1,2,\dots) \tag{8}\]  
In Figure 4, we use \(F^{(t-b)^{\prime}}\) to present the output of the convolutional layers, which is the result of the convolution computation. The rectified linear activation function (or ReLU function) is used as the activation function at the output of each neuron and is calculated according to the expression:  
\[ReLU(x)= \begin{cases}1,&x\geq 0.\\ 0,&x<0.\end{cases}  \tag{9}\]  
The ReLU activation function serves only to allow the output value at a neuron to progress to the next layer if that value is a positive number and any negative numbers have been discarded. ReLU has an advantage over other activation functions in specifying an open range to the right \([0,\ +\infty)\) to eliminate the gradient vanishing problem and thus avoid overfitting [64]. Let \(Z\) be the output values after applying the ReLU activation function, and the output value at every sample \(t-b\) after applying ReLU is calculated as:  
\[Z^{(t-b)}=ReLU\Big{(}conv1D\Big{(}F^{(t-b)},w,\beta\Big{)}\Big{)}. \tag{10}\]  
The final output of the Conv1D layer is a vector \(Z_{b}\), which contains all neuron outputs:  
\[Z_{past}=\Big{(}Z^{(t-b)}\Big{)}=\Big{(}Z^{(t-B)},\dots,Z^{(t-3)},Z^{(t-2)},Z^ {(t-1)}\Big{)},\ \ \ b=B,\dots,3,2,1 \tag{11}\]  
Since the IP data packet flow has the characteristics of a data sequence problem, which is recognizable from the manner in which each packet is sent in succession between two nodes throughout the time interval, we can implement a data series algorithm to train the neural network to predict future incoming data from this pattern.