# A Survey of CNN-Based Network Intrusion Detection
## 9 Conclusions and Research Directions and Gaps  
IDSs play a crucial role in securing networks and computer systems worldwide and employ several AI techniques, such as machine learning, to enhance performance against novel cyber-attack challenges. Deep learning has a significant benefit over other traditional machine learning methods because it can independently detect relevant features in high-dimensional data. Among deep learning algorithms, the CNN has been widely used by researchers to improve IDS solutions regarding privacy issues and security threats. Therefore, this study provides a comprehensive survey of CNN-based IDS schemes. It initially provides the background, in which deep learning is briefly discussed, and the CNN is explained in detail. In addition, popular primary datasets that have been employed by IDS schemes are illustrated in this paper. The overall techniques are categorized into four groups. The overall architectures of the learning methods, datasets, data input shapes, evaluated metrics, performance, feature extraction methods, and classifiers are discussed \begin{table}
\begin{tabular}{c c c c c c c c} \hline \hline \multirow{2}{*}{**Model Type**} & **Num. of CNN Layers** & **Num. of Trainable Params** & **Accuracy (\%)** & **Precision (\%)** & **Recall (\%)** & **F1 Score** & **False Alarm (\%)** \\ \hline \multirow{3}{*}{Basic 1D-CNN} & 1 & 254,721 & 97.99 & 89.54 & 99.75 & 94.37 & 2.37 \\  & 2 & 156,609 & **98.08** & 92.48 & 96.51 & 94.45 & **1.6** \\  & 3 & 119,937 & 97.66 & 88.38 & 99.2 & 93.48 & 2.65 \\ \hline \multirow{3}{*}{Basic 2D-CNN} & 1 & 152,513 & **98.1** & 91.3 & 98.09 & 94.58 & 1.9 \\  & 2 & 78,977 & 97.61 & 91.92 & 94.14 & 93.01 & **1.68** \\  & 3 & 95,553 & 97.74 & 88.64 & 99.37 & 93.7 & 2.59 \\ \hline Hybrid LSTM with \multirow{3}{*}{2D-CNN} & 2 & 76,101 & **98.02** & 90.38 & 98.81 & 94.41 & 2.14 \\ \cline{1-1}  & 2 & 59,850 & 97.55 & 87.65 & 99.54 & 93.21 & 2.85 \\ \cline{1-1} \cline{2-11} Hybrid Autoencoder & 2 & 133,285 & 95.24 & 90.76 & 79.97 & 85.02 & **1.66** \\ \hline \hline \end{tabular}
\end{table} 
Table 13: The experimental results on the CIC-IDS 2017 dataset. \begin{table}
\begin{tabular}{c c c c c c c c} \hline \hline \multirow{2}{*}{**Model Type**} & **Num. of CNN Layers** & **Num. of Trainable Params** & **Accuracy (\%)** & **Precision (\%)** & **Recall (\%)** & **F1 Score** & **False Alarm (\%)** \\ \hline \multirow{3}{*}{Basic 1D-CNN} & 1 & 258,817 & 82.67 & 92.62 & 75.58 & 83.23 & 7.96 \\  & 2 & 156,609 & 84.9 & 93.34 & 79.13 & 85.65 & 7.47 \\  & 3 & 119,937 & **88.87** & 94.93 & 84.98 & 89.68 & **5.99** \\ \hline \multirow{3}{*}{Basic 2D-CNN} & 1 & 152,513 & 85.22 & 93.35 & 79.71 & 85.99 & 7.51 \\  & 2 & 78,977 & **85.59** & 97.18 & 76.92 & 85.87 & **2.95** \\  & 3 & 95,553 & 84.43 & 93.48 & 78.09 & 85.09 & 7.2 \\ \hline Hybrid LSTM with \multirow{3}{*}{2D-CNN} & 2 & 76,101 & **89.93** & 95.47 & 86.42 & 90.72 & **5.42** \\ \cline{1-1}  & 2 & 59,850 & 82.05 & 93.02 & 74.03 & 82.44 & 7.34 \\ \cline{1-1} \cline{2-11}  & 2 & 134,673 & 84.39 & 93.35 & 78.13 & 85.07 & 7.35 \\ \hline \hline \end{tabular}
\end{table} 
Table 14: The experimental results on the NSL-KDD dataset. for each group. This survey illuminates the highly incorporated methods in the researched schemes. Although many researchers have investigated machine learning, deep learning, and CNNs in the IDS context, future researchers may address the following issues:  
* Setting the optimized hyperparameters (i.e., layer structure, learning rate, activation function, and kernel size). These are critical in deep learning approaches, and for this reason, they require further investigation. * Combining misuse detection and anomaly detection through the application of CNN algorithms. This can create hybrid schemes that can effectively manage known and unknown attacks. * Using a comprehensive dataset, including all known and unknown attacks. Big data can now be processed by deep learning, meaning that it is possible to acquire datasets large enough to support all types of known attacks.