# A Survey of CNN-Based Network Intrusion Detection
## 7 Other Factors of CNN-Based IDS Experiments  
In the previous sections of this paper, we discuss the most important elements in the IDS-based CNN; however, there are other factors for training deep neural networks, such as preprocessing, setting hyperparameters, generalization, pretraining, initialization, normalization, and over/undersampling, which greatly affect the performance of the model, some of which are briefly discussed in this section.  
Using too few neurons and layers may affect the model performance in detecting intrusion activities. However, increasing the number of neurons and depths may lead to overfitting, gradient vanishing, and increased training time and cost [52]. Furthermore, the covariance shift arises due to the dynamically shifting input value range from layer to layer in the training process within deep neural networks. Consequently, the learning  
Figure 14: Accuracy of the studied schemes on the CSE-CIC-IDS2018 dataset [21, 23, 27, 51, 54, 66].  
Figure 15: Comparison between binary and multiclass classification of the CNN-based IDS [3, 15, 20, 21, 23, 25, 34, 38, 42, 44, 49, 52, 73, 75, 76, 78].  
outcome becomes volatile due to the learning efficacy of one layer being determined by other layers. Moreover, the learning speed is reduced, as the process of ensuring that data are effectively learned in distinct input ranges restricts the learning rate to a low value due to the covariance shift. This problem can be resolved via batch normalization [38]. The issue of vanishing gradients is addressed while the speed of the learning process is enhanced via skip connections, which connect within neural networks and serve as the input fed to the next layer [20].  
Generally, the several stages outlined below are typically involved in experiments on a CNN-based IDS:  
19. Data cleaning;
20. Numerical processing;
21. Min-max normalization;
22. Standardization (Gaussian normalization);
23. Feature reduction;
24. Dimension reduction;
25. Imbalanced dataset handling;
26. Hyperparameter setting;
27. Vector-to-matrix format conversion;
28. Cross-validation.  
Data cleaning includes removing redundant data and filling in gaps. Moreover, numerical processing generates a digital feature vector by converting non-numeric features, such as categorical and symbolic features, into a numerical format. A general conversion technique is the one-hot encoding approach. For example, in the NSL-KDD dataset, binary encoding of the vectors (0, 0, 1), (0, 1, 0), and (1, 0, 0) represents the ICMP, UDP, and TCP, which are three attributes in \"protocol_type\" [39].  
Substantial variances exist in the dataset's continuous feature data value range. For example, the \"num_shells\" feature value range of [0, 5] contrasts with the \"num_root\" feature value range of [0, 7468] within the NSL-KDD dataset. The linear and uniform mapping of the value range of every feature within the [0, 1] interval is implemented via the min-max normalization technique to streamline the removal of dimensions and support arithmetic processing. The normalized calculation formula is presented below:  
\[x_{normal}=\frac{x-x_{min}}{x_{max}-x_{min}} \tag{4}\]  
where the minimum and maximum values of the feature vector are denoted by \(x_{min}\) and \(x_{max}\), respectively.  
Learning efficiency can be impacted by various distributions with different means and standard deviations within input data. In line with the frequent adoption of multiple machine learning classifiers, standardization is implemented to scale the input data to possess a standard deviation of 1 and a mean of 0. Upon having a variance of 1 and an average of 0, the features can be normalized to a Gaussian distribution using the equation below:  
\[\kappa\prime=\frac{\kappa-\mu}{\delta} \tag{5}\]  
where the standard deviation of the feature vector, the normalized feature, the mean of the feature vector, and the original feature are represented by \(\delta\), \(\kappa\prime\), \(\mu\), and \(\kappa\), respectively.