# LAN Intrusion Detection Using Convolutional Neural Networks
## 3 Proposed System  
The proposed system is presented in this section. The dataset that we utilized to validate the proposed detection model is introduced in the first subsection. The processes for preparing the dataset for model training are described in the second subsection. The structure of the CNN model and the parameters that we utilized to build our suggested approach are discussed in the last part. The following are some publicly available datasets [26]:  
* The DARPA dataset created at MIT Lincoln Laboratories in 1998, 1999, and 2000. The dataset was built by manually entering network-based attacks. The dataset was finished in five weeks, with the final two weeks of data used for testing. * The DARPA 98 dataset was used to create the KDD 99 incursion data. There are 41 features in the dataset, plus one extra attribute per class. * The offline network data in the dataset are based on the KDD 99 dataset [26]. The new NSL-KDD dataset [27] is an upgraded version of the previous one. It comprises the most important records from the entire KDD data collection. To enable the classifiers to generate an unbiased output, redundant records are deleted. The test and training datasets have a sufficient amount of records, which is reasonable and allows experiments to be run on the whole set. The proposed method was evaluated on the dataset, which has 43 characteristics and one class attribute. The new NSL-KDD dataset is smaller than the KDD-99 dataset, which includes duplicate records. For scholars, there is a library of downloadable files available. The proposed method was evaluated on the dataset with 43 characteristics and one class attribute. The 43 features are divided into four categories: the first is the network connection's basic properties; the second is nine features such as the type of protocol, the number of bytes, and so on; the third is the network connection's content attributes, which include 13 features such as the type of protocol, the number of bytes, and so on; and the fourth is the network connection's security features, which include nine features such as the type of protocol, the number of bytes, and so on. NSL-KDD's training set excludes duplicate records, lowering the complexity [27]. In [27], various advantages of the NSL-KDD dataset over the KDD-99 dataset are discussed. The training is carried out with KDD training data, which has 22 attack types, and the testing is performed with KDD test data, which has 17 more attack types. For training and testing, these assaults may be divided into four classes, each having certain common characteristics. In addition, the dataset has 125,973 patterns in the training dataset and 22,544 patterns in the test dataset. The proposed model includes checks for these 17 unknown testing set assaults, making the model more realistic. The assaults are divided into four categories:  
* DoS--A Denial of Service attacks depletes the victim's resources, preventing it from handling genuine requests--for example, syn flooding. \"Source bytes\" and \"percentage of packets with faults\" are two characteristics that are relevant. A malicious party's attempt to deactivate system or network resources and services. * Probe--The attacker gathers information about the target system's possible vulnerabilities, which may then be utilized to conduct attacks on such systems. The goal of observation and other probing attacks, such as scanning port, is to obtain data about the distant victim. \"Connection duration\" and \"source bytes\" are two characteristics that are relevant. * R2L--The ability to transfer data packets over a network to a remote system and gain access as a user or root to carry out unauthorized operations. The attacker gains local and remote machine access to the victim machine via unlawful access from a remote machine. Password guessing is an example for R2L. Features that are relevant include \"duration of connection\" and \"service requested\", which are network-level information, whereas \"number of unsuccessful login attempts\" is a host-level feature.