# A Novel Deep Learning Framework for Intrusion Detection Systems in Wireless Network
## 3 Proposed Strategy
### The Detector
A CNN1D model alone can also represent the features of 1D time-series sequence data by performing 1D convolution operations with multiple filters. However, the ability to extract the feature through the time series of the CNN1D is still limited because the convolution captures neighborhood information limited to the kernel's area and will fail to exploit the time relationship between the long sequence of data from the first packets in the past to the current packets. CNN1D is nonetheless still a feed-forward neural network, which means it has no connection path to allow the association of past information with present information. The most effective method, therefore, is a recurrent neural network. This type of recursive neural network is well-known as a superb tool for solving time series and data sequence problems. To increase memory capability, we can select LSTM or GRU,  
Figure 4: The convolution mechanism. two RNN variants that are commonly applied in practical contexts. We used only LSTM since it functions better than GRU with data containing complex features. The structure of an LSTM cell is illustrated in Figure 5.  
LSTM cells commonly have four components: a cell state and three logical gates, referred to as the forgotten gate, input gate, and output gate. These three gates control the information flow within the cell by removing or adding information to the cell state. An LSTM cell has separate inputs for input information, the previous cell state and the hidden state, which are the corresponding outputs from the previous cell (except for the first cell state and the first hidden state in the network, which are set to a random value), and two outputs which are the hidden state and cell state of that cell. In Conv1D-LSTM, the output \(Z_{past}\) of the Conv1D layer is the input of the LSTM layer, \(h\) and \(c\) are the hidden and cell states, \((t-1)\) indicates the earlier time step in the previous cell, \(t\) indicates the time step in the current cell, and \(\sigma\) and \(tanh\) represent the sigmoid and the hyperbolic tangent activation functions. We also denote the set of matrices \(W_{f}\), \(U_{f}\), \(\beta_{t}\), the set of matrices \(b_{f}\), \(W_{i}\), \(U_{i}\), \(\beta_{i}\), and the set of matrices \(W_{o}\), \(U_{o}\), \(\beta_{o}\), which are three sets of weight matrices and bias vectors associated with the input gate \(i^{(t)}\), forget gate \(f^{(t)}\), and output gate \(o^{(t)}\)[65], respectively. The gates are processed according to the following equations:  
\[f^{(t-b)} =\sigma\ (W_{f}z^{(t-b)}+U_{f}h^{(t-b-1)}+\beta_{f}), \tag{12}\] \[i^{(t-b)} =\sigma\ (W_{i}z^{(t-b)}+U_{i}h^{(t-b-1)}+\beta_{i}),\] (13) \[o^{(t-b)} =\sigma\ (W_{o}z^{(t-b)}+U_{o}h^{(t-b-1)}+\beta_{o}). \tag{14}\]  
The cell state assists the model in remembering a very long sequence. Along with the CNN layer, the system benefits by receiving both time and spatial information to form the basis for near-moment prediction. We indicate the internal output as \(\hat{c}^{(t-b)}\), which is the new information admitted to the input gate. The cell outputs, which are \(c^{(t-b)}\) and \(h^{(t-b)}\), can be calculated according to the element-wise product \(\circ\) (or Hadamard product):  
\[\hat{c}^{(t-b)}=tanh\ \ (W_{c}h^{(t-b-1)}+\ U_{c}x^{(t-b)}+b_{c}), \tag{15}\] \[c^{(t-b)}=f^{(t-b)}\ \circ\ c^{(t-b-1)}+i^{(t-b)}\circ\ \hat{c}^{(t-b)},\] (16) \[h^{(t-b)}=o^{(t-b)}\ \circ\ tanh\ (c^{(t-b)}). \tag{17}\]  
To update the new weight and bias values, the Conv1D-LSTM performs the second task of the gradient descent algorithm using backward propagation through time in combination with convolutional backward propagation to determine the gradient. This procedure  
\[Z_{past}=\Big{(}Z^{(t-b)}\Big{)}=\Big{(}Z^{(t-B)},\dots,Z^{(t-3)},Z^{(t-2)},Z^ {(t-1)}\Big{)},\ \ \ b=B,\dots,3,2,1 \tag{11}\]0 Structure of an LSTM cell. is repeated until the loss reaches its minimum value. Since the process of backward propagation of Conv1D-LSTM requires a lengthy explanation, we recommend reading [66; 67; 68].