# A Survey of CNN-Based Network Intrusion Detection
## 2 Research Method  
To achieve the goals of this research, a systematic methodology was applied. First, we defined the research questions and search terms, and then we searched scientific libraries and performed quality assessments of the schemes. To identify search terms, we studied some survey papers [12; 13; 14] that reviewed deep learning-based IDSs, and we used the research methodology to conduct our research. The above survey papers answer many research questions on deep learning-based IDSs. However, CNN is one of the most important breakthroughs in deep learning; therefore, our decision is to focus on CNN-based IDSs.  
Multiple research questions are posed on the topic of CNN-based intrusion detection schemes, which are covered in this study.  
1. How can the applied CNN-based IDS be categorized into multiple subcategories?
2. How have CNNs been successfully applied to feature selection or feature extraction?
3. What kinds of structures/networks/architectures have been applied to CNN methods?
4. What methodologies have been used for classification and feature extraction?
5. What ML/DL methods have been combined with CNN to create hybrid CNNs?
6. What datasets are employed by IDS schemes?
7. How can the CNN-based IDS be verified, and what evaluation metrics have been employed in IDS schemes?
8. What are the current trends and accuracy results?
9. What are the advantages and disadvantages of the CNN-based IDS approach?  
Selecting the keywords was simple in our research, as we were looking for IDS schemes that used a CNN as the main contribution in their techniques. The main keywords that were chosen were IDS, intrusion detection, CNN, and convolutional neural networks, and we searched for four different possible combinations of these keywords.  
After the search keywords were identified, multiple scientific libraries and platforms were used to search for the required papers, accessed on 1 June 2022: Web of Science (www.webofscience.com), Scopus (www.scopus.com), EBSCOhost (www.ebsco.com), IEEE Explorer (www.ieeexplore.ieee.org), and Science Direct (www.sciencedirect.com).  
After searching the libraries and platforms using the defined keywords, several scientific publications were found. However, only journals or conference papers were selected. Accordingly, we chose a subset of relevant and valuable articles for our survey by conducting a quality assessment and skimming the abstracts. However, among the selected papers, some were unsuitable and removed from the survey. To perform the quality assessment, these criteria were considered:  
* Is the paper focused on intrusion detection?
* Does the paper have any contribution to the CNN-based IDS context?
* Was a complete set of experiments applied to confirm the suggested method?  
Figure 1 exhibits the taxonomy of the CNN-based IDSs established in the searched papers. As shown in this figure, we divided the methods based on environmental D at the first level. The applications include the Internet of Things (IoT), software-defined networking (SDN), in-vehicle networks, smart homes, cloud security, advanced metering infrastructure (AMI), Spark platform, wireless, industrial control system (ICS), and NIDS. Hybrid methods combine one or more machine learning, deep learning, or soft computing methods with a CNN. Then, the single or hybrid CNN can be applied for each environmental application. In contrast, other methods, such as dimensional reduction and feature selection, are categorized as single CNNs. For example, hybrid LSTM means that the authors used the hybrid CNN-LSTM, but single PCA means that the authors used a single CNN and PCA for dimensionality reduction. Each leaf in the taxonomy shows the selected papers for that category.  
Figure 1: Taxonomy of CNN-based IDSs [3; 15; 16; 17; 18; 19; 20; 21; 22; 23; 24; 25; 26; 27; 28].