# A Survey of CNN-Based Network Intrusion Detection
## 1 Introduction  
Worldwide economic and business progress is directly tied to the Internet and enterprise networks. Furthermore, cyber-attacks are becoming increasingly common, which is a significant security concern [1, 2]. For this reason, technicians and network security specialists are paying increasing attention to identifying network attacks [3]. Governments and private organizations require solutions offering stable performance in protecting the information assets they hold from any unlawful or unwanted access and in preventing and detecting intrusions [4]. The term \"intrusion detection system\" (IDS) refers to a system that monitors and categorizes network flows to determine whether they are the typical (normal) activity that frequently occurs in a network or activity that could threaten the security of information systems.  
[PERSON] [5] proposed developing an IDS that would employ artificial intelligence (AI) methodologies to detect abnormal flows and potential intrusions. This approach founded a new branch of IDS, which was developed using learning algorithms. In the past 30 years, various research has employed machine learning methods to investigate the use of IDSs to automatically identify normal and abnormal flows in systems and networks. However, high false alarm and low detection rates still affect IDS solutions.  
A branch of artificial intelligence known as deep learning (DL) has become broadly utilized in the fields of classification and pattern recognition [3, 6, 7]. In general, deep learning applies multiple information-processing layers within a hierarchical design. Furthermore, deep learning is a hot research topic, meaning that several deep neural network (DNN)architectures, such as convolutional neural networks (CNNs) [8]; recurrent neural networks (RNNs) [9]; deep belief nets (DBNs); and autoencoders, including sparse, denoising [10], contractive [11], and variational autoencoders, have been investigated and published. Among the different deep learning algorithms, CNN is effective in complex tasks, such as identifying faces and objects and operating self-driving cars. Therefore, many researchers have attempted to apply CNN to solve the puzzle of IDS.  
Although CNN has been employed for intrusion detection systems in several papers, there is no comprehensive survey paper on CNN-based IDSs, according to the best of our knowledge. Therefore, our first motivation is to provide a complete survey of the literature that addresses original, enhanced, or hybrid CNNs. Secondly, to represent additional perceptions regarding the reviewed approaches, their most important properties, such as the dataset, architecture, input shape, evaluated metrics, performance, feature extraction method, and classifier, are presented and explained. The third motivation of this study is to compare the CNN schemes used in the research works. However, our challenge is that researchers used different datasets, and thus, such a comparison is not feasible. To overcome this challenge, we conducted an empirical experiment on famous CNN-based approaches by using standard datasets and applied these experimental results for comparison purposes in this research.  
The present paper is structured in the following way: The background of the study is presented in Section 2. The performance metrics used to measure model performance in IDSs are discussed in Section 3. Subsequently, in Section 4, the IDS schemes that employed CNNs are investigated and compared. An analytical investigation is presented in Section 5, and an empirical experiment is shown in Section 6. Finally, the conclusion, research directions, and gaps are given in Section 7, in which ongoing challenges related to CNN-based intrusion detection are highlighted.