# A Survey of CNN-Based Network Intrusion Detection
## 6 Analytical Investigation  
In this section, the issues surrounding the CNN-based IDS systems discussed previously in the paper are outlined. Thus, it is important to present some statistics to illustrate these issues, such as the following:10. The annual percentage of CNN-IDS papers published. 11. The percentage of IDS approaches that have employed 1D and 2D input as the input dimension of the CNN. 12. The percentage of IDS solutions employed in various intrusion detection datasets to assess performance. 13. The percentage of the use of implementation frameworks that have been trialed for IDS schemes. 14. The number of convolutional layers added in CNN-based models, which indicates the depth of the models. 15. The percentage of each evaluation metric used to test the IDS schemes. 16. The accuracy of the studied IDS approaches when using specific datasets. These statistics are provided for the 66 CNN-based IDS approaches investigated in the previous section of this paper. Figure 4 shows that researchers have developed and tested many CNN-based approaches in order to find a solution to the IDS issue. Of all of the studies reviewed in this work, 3% were published in 2017, and 28.4% were published in 2021. It is also important to note that the papers selected for 2022 were all published before July 2022. This is a clear indication that research attention in this field is growing rapidly. The CNN specializes in processing data with a grid-like architecture (e.g., images). Thus, numerous CNN-IDS studies have reshaped the input features into a matrix shape (2D). Furthermore, several studies have used 1D data features as the input for CNN models. The application of the image format has been found to lower the number of computed parameters required in a CNN model [112]. A one-dimensional array can be converted into a two-dimensional (2D) or three-dimensional (3D) image. The 49-feature vector has been converted into a 7 \(\times\) 7 matrix in several studies. In instances where the number of features is not squared, zeros can be added to the feature vector. On the other hand, researchers [70] attempted to fill eight gaps in the matrix using zero values in random cells (this was possible because the initial feature set had a dimensionality of 41, with 49 cells to be filled in the matrix in total). Figure 5 shows the percentage of IDS methods that used 1D and 2D input shapes to achieve this. This figure demonstrates that 62.9% of the methods use 2D input, whereas only 37.1% apply 1D input. In Figure 6, the datasets used in the CNN-based IDS approaches investigated in this study are presented. The figure shows that 35.2% of IDS approaches still use NSL-KDD, while 15.4% use the KDD Cup99 legacy dataset. Moreover, to carry out a more comprehensive assessment of the proposed approaches, multiple datasets were used in some instances. Altogether, 13.2% of the studies included in this review evaluated the CIC-IDS2017 dataset. Figure 4: Percentages of CNN-IDS papers published each year. In Figure 7 below, the percentages of the implementation simulators/environments employed in the experiments and evaluation processes are outlined. As shown in the figure, 40.4% of IDS implementations were carried out using TensorFlow, 38.6% used Keras (with the TensorFlow backend), and 10.5% used MATLAB. Figure 5: Percentages of IDS schemes that have used 1D or 2D (image) input shapes. Figure 6: Percentages of datasets applied in CNN-IDS solutions. Figure 7: Percentage of implementation simulators/environments employed in the experiments. In Figure 8, the number of convolutional layers utilized by the IDS schemes can be seen. This figure shows that two convolutional layers are employed in 32 approaches. Moreover, ten IDS approaches seem to apply more than three convolutional layers. In Figure 9, the number of IDS approaches employed in each evaluation metric is presented.