# A Survey of CNN-Based Network Intrusion Detection
## 5 CNN-Based IDS Approaches
### Single CNN-Based Schemes
have been developed according to the field-to-pixel philosophy, which is beneficial to the CNN because it enables the convolutional characteristics of each pixel to be extracted. However, the direct method is the most intuitive technique for field-to-pixel conversion because it accurately reflects an image's convolutional features in the CNN. One specific DoS category was investigated in [PERSON] et al. 's [20] work. They also examined how different attacks within the same category can be detected. To do this, they considered the hyperparameters for 18 scenarios, including the image type, kernel size, and several convolutional layers. They established binary and multiclass classifications for each scenario, after which they identified the best and highest-performing scenarios. Their findings indicated that the model with three convolutional layers and kernel sizes of \(2\times 2\) and \(3\times 3\) performed best. However, when the kernel size increased to \(4\times 4\), the model that involved two convolutional layers was the most accurate. Performance was generally high in multiclass classification when multiple convolutional layers were present. Nonetheless, kernel size did not appear to significantly affect binary or multiclass classifications. A CNN architecture was proposed in the research performed by [18], which is called a means-convolutional layer (CNN-MCL). This layer functions by learning abnormal content features and detecting that specific anomaly in the future. The new CNN-MCL model enables a robust network intrusion detection system that involves a new type of convolutional layer that allows for low-level abnormal features to be learned. Table 5 compares the experimental information, including the authors, the year of publication, ENV, datasets that are used for training and evaluation performance (binary and multiclass accuracy results), and evaluation metrics for group 1 (Single CNN-Based IDS) schemes. Table 6 compares architectural properties such as architecture, input layer shape, feature extraction method, other methods used alongside the CNN, and classification method for group 1 (Single CNN-Based IDS) schemes. \begin{table}
\begin{tabular}{c c c c c} \hline \hline
**Authors** & **Architecture** & **Input Shape** & **Feature Extraction** & **Classifier** \\ \hline [PERSON] et al. [3] & 5 Conv, 1 MaxPool, 1 FC & 2D & GA, KNN, FCM, CNN & BG classifier \\ [PERSON] et al. [70] & 1 Conv, 4 FC & 2D (7 \(\times\) 7) & Deep Siamese CNN & AdaBoost \\ [PERSON] et al. [71] & 4 Conv,1 FC & 2D & CNN & SoftMax \\ [PERSON] et al. [72] & 1 Conv, 1 MaxPool, 2 FC & 2D (\(6\times 7\)) & K-means, PCA, CNN & FC, SoftMax \\ [PERSON] et al. [73] & 2 Conv, 2 MaxPool, 1 Flatten, 2 FC & 2D (\(28\times 28\times 3\)) & CNN & FC, SoftMax \\ [PERSON] et al. [74] & 1 Conv, 1 FC & 2D (\(11\times 11\)) & CNN+SVDD & One-class \\ [PERSON] et al. [75] & 2 Conv, 2 MaxPool, 1 FC & 2D & CNN, FC & Ensemble \\ [PERSON] et al. [76] & 2 Conv, 2 MaxPool, 2 Dropout, 3 & 1D & RSA, CNN & SoftMax \\  & FC, 1 Batch No & & & GLCM, fuzzy K-means, \\ [PERSON] et al. [77] & — & — & & CNN \\ [PERSON] et al. [78] & 2 Conv 2 BatchNo, 2 MaxPool, 3 & & & \\  & Dropout, 1 Flatten, 2 FC & 1D & PCA, CNN & SoftMax \\ \hline \hline \end{tabular}
\end{table} 
Table 12: Architectural properties of group 4 (Hybrid CNN and Machine Learning) IDS schemes.