# A Novel Deep Learning Framework for Intrusion Detection Systems in Wireless Network
###### Abstract
Therefore, to maximize the protection, it is better to develop a system that can estimate and predict the network traffic status in a short amount of time based on the recent traffic status history. This will allow the IDS to estimate how the traffic will behave in the near future and detect any potential threats that can occur based on past data and the current traffic flow status. This will contribute to making the IDS more active in their observation duty and give them more time to deal with the attacks, thus increasing the efficiency of the protection. One more advantage is that, when actively estimating the traffic for a certain duration, the IDS can be based on not only the current status of the traffic but also the predicted status to decide if there is a potential attack about to occur or not. Hence, the false alarm rate will be reduced in the future. Regarding this approach, there have been very few frontier studies that have tried to develop the IDS this way. The latest and closest research to this approach is [39], where the authors propose a strategy of using a combination of a CNN, LSTM, and attention models to predict the future \(T\) packets. The research shows promising results in which their best model obtained an F1 score (the F1 score is a metric used to evaluate the performance of classification tasks [40]) of 83% for the T = 1 packet scenario and reached a 91% F1 score for forecasting an attack in the subsequent T = 20 packets. However, there is no imbalanced data consideration in their contribution, which leads to a reduction in the accuracy of the strategy they used, and the combination of three separate models can consume the processing time and resources of the IDS. Another common limitation of these former contributions that affected the accuracy and precision of prediction is the imbalance in the datasets they used. These include AWID [41; 42], CICIDS2017, CSE-CICIDS2018 [28], LITNET, and KDDcup [43]. Some older datasets are still in use, for example, KDD-1999, DARPA 1999, and KDDCup-99 [44; 45], and are applied in anomaly, signature, and hybrid-based IDSs and the family of KDD (Knowledge Discovery and Data mining) datasets [46]. No matter what datasets they use and how good they are, they all have a common flaw, which is the imbalance between categories in the datasets. Typically, this flaw comes from the fact that anomaly traffic data, like attacks, is often a rare event compared to the vast amount of normal traffic in a network. As a result, the algorithm may not have enough examples of attack behavior to learn its distinctive features effectively, making it more prone to misclassification. Suppose the dataset used to train the detection algorithm has a disproportionate amount of normal traffic data compared to attack data. In that case, the algorithm may become biased toward classifying new instances as normal. This bias can lead it to misclassify actual attacks as normal (false negatives) or flag harmless anomalies as attacks (false positives). This is the cause of high false alarming errors in a majority of current IDS. According to [7], the factor of imbalanced data is unavoidable due to the nature of the cyber security problem, where the \"Normal\" behavior outnumbers the attacks considerably. As [PERSON] claimed in [47], there is almost no ultimate technique or method to completely treat the imbalanced data in wireless networks, and depending on the utilized dataset, the researchers will, based on their experience and knowledge, choose the best approaches to deal with their data. These approaches have been studied and applied in numerous research, such as in [48; 49; 50], where the authors applied an ML algorithm to reduce the effect of the imbalanced datasets they used; in the contribution [51], the authors introduce using a semi-supervised learning model in IDS.