# A Novel Deep Learning Framework for Intrusion Detection Systems in Wireless Network
###### Abstract
The advent of DL, a subset of ML, has opened up new avenues for intrusion detection. DL algorithms, inspired by the structure and function of the human brain, excel at automatically learning intricate patterns and representations from vast amounts of data. This ability to discern subtle anomalies and correlations within network traffic makes DL a promising tool for identifying malicious activity that might elude traditional IDS methods. Some early frontiers in this area are [PERSON] and his partners, who performed the research [25], which proposes a novel approach using an enhanced Bat algorithm to train a multilayer perceptron for intrusion detection, highlighting the potential of nature-inspired optimization. The emergence of Graph Neural Networks (GNNs) for IDS has shown promising results due to their ability to model complex network relationships. The authors of [26; 27] provide comprehensive surveys on GNNs in IDS, highlighting their adaptability to evolving network structures, although challenges with computational cost and interpretability remain. DL architectures like Convolutional Neural Networks CNNs and Generative Adversarial Networks (GANs) have also been explored. [PERSON] et al., in [28], demonstrated the feasibility of using CNNs and GANs for intrusion detection, but generalization and adversarial robustness remain concerns. [PERSON] et al., in [29], surveyed CNN-based IDS, emphasizing their capability of automatic feature extraction while noting the need for careful hyperparameter tuning. In recent years, more advanced DL structures and hybrid models combining different DL architectures have also been investigated. [PERSON] et al. [30] proposed a CNN-based model with regularization for SDNs, while [PERSON] et al. [31] introduced a hybrid Recurrent Neural Network (RNN) with feature optimization. Both show promise but require further validation and generalization. The use of Long Short-Term Memory Networks (LSTM), one of the variants of RNN for IDS, has been explored in various studies. Contributions such as [32; 33] were focused on investigating the LSTM-based IDS for host-based and network-based intrusion detection, respectively. These studies demonstrated the effectiveness of LSTMs in capturing temporal dependencies in network traffic, but the need for large labeled datasets remains a challenge. Further advancements include Bidirectional LSTM (BiLSTM) and hybrid CNN-LSTM models. [PERSON] et al. [34] and [PERSON] et al. [35] utilized BiLSTMs for intrusion detection, showcasing their ability to capture bidirectional temporal relationships. However, the computational cost associated with training deep BiLSTM models remains a concern. And the most advanced approach is the hybrid between CNN and RNN (LSTM or GRU), which demonstrates their efficacy in capturing temporal dependencies in network traffic in both time and space aspects, as shown in the contributions [36; 37; 38]. They offer vastly improved performance and introduce computational complexities but require further research to exploit their full potential in developing IDS. Almost all of the mentioned contributions and studies have focused on classification approaches. That means the systems only detect and classify the attacks at the moment they occur and, thus, leave the system passive in observation and protection. As a wise idiom said: \"An ounce of prevention is worth a pound of cure\". No matter how fast an IDS solves the problem, there is a possibility that the attacks will occur successfully and will more or less damage the wireless system. This is true especially for some dangerous attacks, such as DDoS, because they quickly flood the system with bots and barely give enough time for the system to recognize the attack and decide on a solution to fix the problem. Furthermore, according to their contributions, the IDS can never achieve 100% correctness in prediction, which means there will always be a possibility of wrong prediction. When this happens, the lack of response time can leave the system vulnerable.