# A Survey of CNN-Based Network Intrusion Detection
## 3 Background of Study
### Convolutional Neural Network  
A CNN is a deep learning model used to process data such as images, and it is based on the arrangement of the animal visual cortex [89]. It is primarily designed to automatically and adaptively learn the spatial hierarchies of features in low- to high-level patterns [90]. It has been proven to be effective in several tasks, including face identification, object identification, and traffic sign detection, most notably in robotics and self-driving cars [15; 16]. Minimizing the number of parameters in an ANN is the most critical aspect of a CNN, which has motivated developers and researchers to focus on larger models that can be used to solve complicated tasks, which is impossible with traditional ANNs [91].  
The key purpose of a CNN is to learn the relevant features of the input data. In this process, the initial layers are a set of convolutional feature extractors that are subjected to learnable filters. The applied filters serve as a sliding window that moves across every piece of input data. In this case, the overlapping distance is referred to as the stride, with the outputs being known as feature maps. Convolutional kernels make up each CNN layer, which is used to make different feature maps. Neighboring neuron areas are connected to a neuron in the next layer's feature map. To create a feature map, the kernel must be shared across all spatial locations of the input. After the convolutional and pooling layers have been established, one or several fully connected layers are utilized to finish the classification [92; 93; 94; 95]. As an example, Figure 2 illustrates the layers of the LeNet CNN architecture, in which each box represents a different feature map [17].  
Figure 2: The layer structure of the LeNet architecture (example of CNN-based model).  
The following equation represents the convolutional operation across the input feature maps and convolutional layers in CNN architectures:  
\[h_{j}^{(n)}=\sum_{k=1}^{K}h_{k}^{(n-1)}\ \bigotimes\ w_{kj}^{(n)}+b_{kj}^{(n)} \tag{1}\]  
where \(\bigotimes\) represents a 2D convolution, and \(h_{j}^{(n)}\) denotes the output of the \(j^{th}\) feature map in the \(n^{th}\) hidden layer. Meanwhile, \(h_{k}^{(n-1)}\) denotes the \(k^{th}\) channel of the \((n-1)^{th}\) hidden layer, \(w_{kj}^{(n)}\) represents the weights of the \(k^{th}\) channel in the \(j^{th}\) filter of the \(n^{th}\) layer, and \(b_{kj}^{(n)}\) denotes the relevant bias term. Collecting multiple convolutional layers creates a vast number of feature maps, and to reduce the dimensionality of these properties, an additional layer is usually added to the convolutional layers. This is known as a pooling layer, and it helps to minimize the computational expense needed to train a network, as well as reduce the chances of overfitting.  
To complete the training of a CNN, an iterative algorithm is applied that moves between feed-forward and backpropagation data motions. The convolutional filters and fully connected layers are modified during each iteration of the backpropagation process. The key purpose is to reduce the average loss \(E\) for all of the true class labels and the network outputs. For example,  
\[E=\frac{1}{m}\ \sum_{i=1}^{m}\sum_{k=1}^{c}\ \hat{y}_{i}^{(k)}\ \log\Bigl{(}y_{i}^{(k)} \Bigr{)} \tag{2}\]  
where \(\hat{y}_{i}^{(k)}\) represents the true label, and \(y_{i}^{(k)}\) represents the network output of the \(i^{th}\) input in the \(k^{th}\) class. Moreover, \(m\) denotes the training input, and \(c\) denotes the neurons in the output layer. To reduce the average loss, several solutions have been proposed [96, 97, 98], with stochastic gradient descent (SGD) and adaptive moment estimation (Adam) [18, 98] being two of the most widely applied. In the remainder of this section, the important components (layers) of the CNN are explained in more detail.