# A Survey of CNN-Based Network Intrusion Detection
## 5 CNN-Based IDS Approaches
### Single CNN-Based Schemes  
In this section, research that focuses on original and improved versions of CNNs without incorporating any other machine learning or deep learning algorithms is presented and discussed. Some researchers have investigated feature preprocessing, data reduction, feature fusion, and imbalanced data management; others have focused on enhancing the CNN algorithm. \begin{table}
\begin{tabular}{c c c c c c} \hline \hline
**Authors** & **Architecture** & **Input Shape** & **Feature Extraction** & **Classifier** \\ \hline [PERSON] et al. [15] & 4 Conv,2 MaxPool, 1 FC & 1D & CNN, DAE & SoftMax \\ [PERSON] et al. [63] & 2 Cov, 2 MaxPool, 1 FC & 1D & CNN & RF \\ [PERSON] et al. [64] & 2 Conv, 2 MaxPool & 2D (\(11\times 11\)), & & \\ [PERSON] et al. [65] & 2 Inception, 2 Conv, 2 MaxPool, 1 FC & 2D (\(11\times 11\)) & CNN & SoftMax \\ [PERSON] et al. [66] & 6 Conv, 3 MaxPool, 1 flatten, 2 FC & 2D (\(256\times 256\)) & CNN & SoftMax \\ [PERSON] et al. [69] & 2 Conv, 2 MaxPool, 2 FC & 2D (\(10\times 10\)) & CNN, PCA, AE & SoftMax \\ [PERSON] et al. [67] & 1 Transformer, 1 Conv, 1 MaxPool, & & 2D & Transformer, CNN & FC (Sigmoid) \\ [PERSON] et al. [68] & — & 2D & Attention, CNN & Capsule, SoftMax \\ \hline \hline \end{tabular}
\end{table} 
Table 10: Architectural properties of group 3 (Hybrid CNN and Deep Learning) IDS schemes. \begin{table}
\begin{tabular}{c c c c c c} \hline \hline
**Authors** & **Year** & **ENV** & **Datasets** & \begin{tabular}{c} **Binary** \\ **Accuracy (\%)** \\ \end{tabular} & \begin{tabular}{c} **Multiclass** \\ **Accuracy (\%)** \\ \end{tabular} & \
\begin{tabular}{c} **Evaluation Metrics** \\ \end{tabular} \\ \hline \multirow{3}{*}{
\begin{tabular}{c} [PERSON] et al. [3] \\ [PERSON] et al. [70] \\ [PERSON] et al. [71] \\ [PERSON] et al. [72] \\ [PERSON] et al. [73] \\ [PERSON] et al. [74] \\ [PERSON] et al. [75] \\ \end{tabular} } & 2020 & M & NSL-KDD & 98.24 & 98.20 & ACC, TPR, FPR \\  & 2020 & M & NSL-KDD & 86.64 & — & ACC \\  & 2021 & W, T & CIC-IDS2017 & 98.00 & — & ACC, PPV, TPR, F1 Score \\  & 2018 & T & KDD Cup99 & 96.38 & — & ACC, FNR \\  & 2021 & M & CIC-IDS2017 & 99.35 & 98.76 & ACC, PPV, TPR, F1 Score, FPR, TNR \\ [PERSON] et al. [74] & 2020 & — & KDD Cup99 & 91.6 & — & ACC, FPR, PPV, TNR, FNR \\  & 2020 & — & NSL-KDD & 99.39 & 99.02 & TPR, FPR, ACC \\  & & & UNSW-NB15 & 98.68 & 94.76 & TPR, FPR, ACC \\  & & & KDD Cup99 & 92.34 & 92.04 & \\ [PERSON] et al. [76] & 2022 & P & NSL-KDD & 77.81 & 76.11 & ACC, PPV, TPR, F1 Score \\  & & & CIC-IDS2017 & 99.99 & 99.02 & \\  & & & BoT-IoT & 99.993 & 99.91 & \\  & 2021 & — & KDD Cup99 & 95.28 & — & ACC, PPV, TPR, F1 Score, Time \\  & 2022 & KT & NSL-KDD & 99.34 & 99.13 & ACC, F1 Score \\ \hline \hline \end{tabular}
\end{table} 
Table 11: Properties of group 4 (Hybrid CNN and Machine Learning) IDS schemes. \begin{table}
\begin{tabular}{c c c c c c} \hline \hline  
A two-step preprocessing strategy was put forward by [PERSON] et al. [20], combining dimensionality reduction and feature engineering. Additionally, deep-feature synthesis was employed to create meaningful features. On the other hand, [PERSON] et al. [21] employed statistical behaviors rather than typical anomalous attack behaviors because they are easier to compute and extract without jeopardizing efficiency. According to [PERSON] et al. [22], the input data of the CNN may perform better than other deep learning models in network IDSs if they can train the kernel to sufficiently reflect the network features. However, effective preprocessing is required for this; thus, the researchers recommended carrying out preprocessing using the \"direct\" method. This enables the network IDS to use the kernel's features by employing the minimum protocol information, field size, and offset. They also recommend two other preprocessing methods: \"weighted\" and \"compressed.\" Additionally, network information is required to use these methods. The methods recommended by [PERSON] et al.