# A Survey of CNN-Based Network Intrusion Detection
## 3 Background of Study
### Convolutional Neural Network
#### 3.2.1 Convolutional Layers  
The name CNN was developed from convolution operations. The convolutional layer plays a critical role in the CNN architecture because it is the component that carries out feature extraction. The layer usually contains both linear and nonlinear operations, i.e., a convolution operation and an activation function [90]. Additionally, convolution operations apply a filter (or kernel) to protect the spatial relationship between pixels by using learning features. The terms \"activation map\", \"convolved feature\", and \"feature map\" are used to describe the data produced during a convolution operation. When a CNN is training to learn the features of a new input more effectively, the values of the kernel are automatically modified. The dimensional values of depth (i.e., the number of filters applied), stride (i.e., the number of pixels by which the filter slides), and zero padding (i.e., padding data with zeros at the border) determine the size of the feature map.  
It is assumed that the input of the neural network is a color image measuring 32 \(\times\) 32 \(\times\) 3 pixels in width, height, and depth; thus, to ensure that the input layer is only connected to one neuron, the weight connections must be 32 \(\times\) 32 \(\times\) 3. However, if the same values of height and width are used to connect the input image to the neurons in the subsequent layer, 3,145,728 weight connections are required because the input layer and the subsequent layer should have 32 \(\times\) 32 \(\times\) 3 = 3072 and 32 \(\times\) 32 = 1024 neurons, respectively. Moreover, as the second layer is dense, the number of required weights is 3072 \(\times\) 1024 = 3,145,728.  
A more efficient method is thus needed, and identifying local regions in the image rather than the entire image may be more efficient than the previously described method. In terms of the convolutional layer, the hidden neurons in the next layer can only receive inputs from the corresponding (neighbor regions) section of the preceding layer. For instance, the layer can only be connected to 5 \(\times\) 5 neurons. Therefore, referring back to the example dimensions presented above, the size of the connection decreases significantly from 3,145,728 to 76,800. In the convolutional layer, the weight of the filter is shared; therefore, the number of weights is 3072 \(\times\) (5 \(\times\) 5) = 76,800.  
Another advantage of this approach is that fixing the weights for the local connections represents the actions of a sliding window measuring 5 \(\times\) 3 in the input neurons and mapping the output in the corresponding location. This enables features to be recognized and identified wherever they are located in the input data [91].  
The key purpose of using a convolutional layer to train a CNN model is to enable the most efficient and suitable kernels for a given task to be determined based on the training dataset provided. Kernels are the only parameters that are learned automatically in the convolutional layer during training. This process is demonstrated in Table 1, which outlines the kernel sizes, numbers, padding, and strides as the hyperparameters that must be established before training can be initiated [90]. In addition, a list of parameters and hyperparameters of a CNN is presented in Table 1.