Network Intrusion Detection Method Based on CNN-BiLSTM-Attention Model

Abstract

To address the issue of low accuracy and high false positive rate in existing intrusion detection methods, a network intrusion detection model based on Convolutional Neural Network, Bidirectional Long Short-Term Memory, and attention mechanism in this paper. Convolutional Neural Network is used to extract the spatial features from the intrusion data, Bidirectional Long Short-Term Memory is used to mine the temporal features from the data further, and the attention mechanism is added to enhance the role of important features in the calculation process through assigning different weights to the extracted spatiotemporal features, thereby improving the classification accuracy of the model. In addition, for the problem of class imbalance existing in network intrusion data, Equalization Loss v2 is introduced as the loss function of the CNN-BiLSTM-Attention model in this paper, making the model pay more attention to minority attack class data during training, thereby improving the detection rate of the model for the minority class data. Finally, comparative experiments are conducted on NSL-KDD, UNSW-NB15, and CIC-DDoS2019 datasets. The experimental results show that the model in this paper outperforms the other models in terms of accuracy, detection rate, and false positive rate.