# Deep Feature Fusion via Transfer Learning for Multi-Class Network Intrusion Detection
## 6 Conclusions  
This study proposed a multi-class deep learning model that applies transfer learning-based feature fusion for network attack detection. To address the limitations of existing intrusion detection systems, which struggle to predict new attack types effectively, this study mitigated the data shortage problem through transfer learning and enhanced detection accuracy for new attack types by incorporating feature fusion techniques. The experimental results demonstrated that the proposed model exhibited the smallest performance degradation among all comparison models, even in scenarios where the amount of training data was reduced through the transfer learning process between the source and target domains. Additionally, it was confirmed that binary and multi-class classification models applying feature fusion techniques achieved significantly improved performance compared to existing methods. The study demonstrated that transfer learning for relatively minor class data mitigated the class imbalance problem, resulting in enhanced classification performance. In terms of overall performance, the proposed model surpassed all comparison models, achieving 94.21% accuracy and 94.16% F1-score, outperforming traditional machine learning techniques. Therefore, this study enhanced cybersecurity defenses and demonstrated the potential for more effectively detecting newly emerging attack types by introducing a network intrusion detection model that leverages feature fusion techniques extracted through transfer learning. Figure 7: Confusion matrix of the model for each attack type: (**a**) results of Confusion matrix of the CNN (NoTL) model for each attack type; (**b**) results of Confusion matrix of the proposed model for each attack type. Meanwhile, the training and prediction performance on the attack types removed during the experiments remains challenging. To address this, future research will explore techniques for augmenting rare classes to mitigate the data imbalance problem and enhance the model's adaptability in responding to the evolving cyberthreat landscape more effectively. Specifically, future work will focus on applying data augmentation techniques, such as oversampling, generative adversarial network-based synthesis, and diffusion model-based synthesis, to generate additional samples for underrepresented attack types and incorporate them into the model proposed in this study. These efforts are expected to improve the model's robustness and enhance its effectiveness in responding to the evolving cyberthreat landscape. Conceptualization, S.L., D.R. and J.-H.B. ; methodology, S.L., J.-H.B. and J.Y. ; software, S.L. and D.R. ; validation, J.-H.B., J.L. and D.M. ; formal analysis, J.L. and D.M. ; investigation, S.L., D.R., J.-H.B. and J.Y. ; resources, J.-H.B. and J.Y. ; data curation, S.L. and D.R. ; writing--original draft preparation, S.L. and D.R. ; writing--review and editing, S.L., D.R. and J.-H.B. ; visualization, D.M. and J.L. ; supervision, J.-H.B., J.Y. and J.L. ; project administration, J.-H.B. and J.Y. ; funding acquisition, J.-H.B. and J.Y. ; All authors have read and agreed to the published version of the manuscript. This work was supported by Institute of Information & Communications Technology Planning & Evaluation (IITP) grant funded by the Korea government (MSIT) (RS-2023-00235509, Development of security monitoring technology based network behavior against encrypted cyber threats in ICT convergence environment). Not applicable. The datasets analyzed in this study, CIC-IDS2017 and CIC-IDS2018, are publicly accessible and can be downloaded from the Canadian Institute for Cybersecurity (CIC) at the University of New Brunswick (UNB).