# Deep Feature Fusion via Transfer Learning for Multi-Class Network Intrusion Detection
## 4 Proposed Method
### Overview of the Proposed Model  
This study proposes a transfer learning-based feature fusion model that effectively transfers learned knowledge representations between domains to improve intrusion detection performance. Transfer learning enhances model generalization by adapting knowledge acquired from a source domain to a target domain [33]. Feature fusion, in parallel, integrates features from multiple sources or domains into a unified representation, enabling the model to capture complementary patterns for enhanced classification performance. The proposed design aims to mitigate the challenges posed by evolving threat patterns in real-world environments by employing a transfer learning-based feature fusion strategy. This approach enables the model to effectively capture both general anomaly patterns and fine-grained characteristics of specific attack types.  
The proposed model consists of three main stages to achieve this purpose.  
1. First, binary and multi-class classification models are constructed by training on the CIC-IDS2017 dataset in the source domain.
2. Subsequently, these models are transferred to the target domain using the CIC-IDS2018 dataset and retrained to adapt to updated traffic patterns and newly emerging attack types.
3. Finally, the feature representations extracted from these retrained models are systematically fused, and final fine-tuning [34] is performed utilizing the CIC-IDS2018 dataset to execute a multi-class classification of network attack types.  
Figure 2 illustrates the training methodology of the proposed model. The training process begins in the source domain (CIC-IDS2017), where two separate CNN-based models are trained in parallel.  
1. Source Model #1 performs binary classification (normal network traffic and attack traffic) to detect the presence of malicious traffic.
2. Source Model #2 handles multi-class classification to categorize attack traffic into specific attack typologies further.  
Upon completion of training, knowledge representations from both Source Model #1 and Source Model #2 are systematically transferred to the target domain through transfer learning mechanisms.  
Subsequently, in the target domain, both Source Model #1 and Source Model #2 undergo retraining using the CIC-IDS2018 dataset, incorporating contemporary network intrusion data. This adaptive retraining process optimizes the models to accommodate the evolving network environment and emerging attack vectors in the target domain, thereby minimizing performance degradation resulting from domain disparities.  
In the final phase, features extracted from the retrained Source Model #1 and Source Model #2 are strategically fused at the high-level feature layer, where semantic representations from both the binary and multi-class pathways are aggregated. This combined representation captures both general threat patterns and specific attack signatures, enhancing the model's ability to distinguish between various types of intrusions. A subsequent fine-tuning process further refines the model for multi-class classification across six distinct categories (normal traffic plus five attack types), including identifying novel attack patterns absent in the source domain.  
Figure 2: Overview of the proposed model training process.  
By synthesizing information from both detection and classification pathways, the proposed architecture achieves high precision in multi-class intrusion detection tasks. This strategy yields superior detection performance and enhanced generalization capabilities in diverse network environments compared to conventional single-model methodologies [35].