# A Complete EDA and DL Pipeline for Softwarized 5G Network Intrusion Detection
## 3 Proposed Approach
### Description
This module focuses on using three different types of DL models for softwarized 5G network intrusion detection, namely \"dense autoencoder neural network\", \"convolutional neural network\", and \"recurrent neural network\" models. 1. Dense Autoencoder Neural Network Model: The first DL model is the dense autoencoder neural network model. This model uses an autoencoder to enhance a dense neural network (DNN) model. An autoencoder is a type of unsupervised deep learning model that uses a combination of backpropagation and compression to reconstruct an output as accurately as possible [51; 52]. It allows for an accurate latent representation of the original features, while minimizing the effects of linearity [51; 52]. On the other hand, a DNN is a fully connected supervised learning neural network model, in which each neuron in each layer is connected to every other neuron in previous and subsequent layers [53]. The autoencoder component is used for feature extraction, while the DNN component learns the characteristics for accurate prediction. Hence, this model leverages the power of DL to learn complex patterns and representations from the input data, while reducing its dimensionality, thereby improving the computational efficiency and generalization performance. 2. Convolutional Neural Network Model: The second DL model considered is the convolutional neural network (CNN) model. CNNs are a type of feedforward neural network that can extract features using convolution operations [54; 55]. Convolution operations are basically an inner product computation between the weight vector and the vectorized version of the input feature set of the previous layer in the neural network architecture [56]. The advantage of CNNs compared to other deep neural network models are threefold, namely allowing for local connections, which eliminates the need for a fully connected architecture; facilitating weight sharing, which reduces the number of parameters to be determined; and achieving dimensionality reduction by using a pooling layer to reduce the amount of data needed, while retaining useful information [54; 55; 56]. This makes them a reliable and attractive option for many applications and fields. 3. Recurrent Neural Network Model: The third DL model considered is the recurrent neural network (RNN) model. RNNs are a feedforward neural network architecture with at least one feedback loop [57; 58]. The goal is to achieve some form of \"memory\" regarding the learning process [57; 58]. Consequently, RNNs are able to perform \"temporal processing\" and \"learn sequences\", i.e., they are capable of dealing with time-sequence data and can identify patterns that repeat over time [57; 58]. This represents an advantage over other DL-based models and architectures, as they are able to not just learn patterns within a data sample, but also across several sequential data samples [59]. This makes them suitable for a variety of applications, such as natural language process, audio and video data processing, stock prediction, and cybersecurity [60]. The proposed approach has an attractive feature in that it can be adopted in various scenarios. More specifically, it can be deployed in a distributed manner at the network edge level or in a centralized manner at the core level, with each option having its own advantages and disadvantages. In the case of the distributed edge level deployment, the DL-based intrusion detection module would be deployed at the 5G base station. Consequently, traffic from users that is sent to the base station is investigated to determine if there are any malicious users that are initiating attacks. The advantage of such a deployment scenario is that it provides a more granular monitoring for network attacks. Additionally, this can offer real-time detection capabilities, as the data are analyzed closer to the source.