Many studies utilized machine learning schemes to improve network intrusion detection systems recently. Most of the research is based on manually extracted features, but this approach not only requires a lot of labor costs but also loses a lot of information in the original data, resulting in low judgment accuracy and cannot be deployed in actual situations. This paper develops a DL-IDS (deep learning-based intrusion detection system), which uses the hybrid network of Convolutional Neural Network (CNN) and Long Short-Term Memory Network (LSTM) to extract the spatial and temporal features of network traffic data and to provide a better intrusion detection system. To reduce the influence of an unbalanced number of samples of different attack types in model training samples on model performance, DL-IDS used a category weight optimization method to improve the robustness. Finally, DL-IDS is tested on CICIDS2017, a reliable intrusion detection dataset that covers all the common, updated intrusions and cyberattacks. In the multiclassification test, DL-IDS reached 98.67% in overall accuracy, and the accuracy of each attack type was above 99.50%.

中文翻译：

---

DL-IDS：使用CNN-LSTM混合网络提取特征以用于入侵检测系统

最近，许多研究利用机器学习方案来改进网络入侵检测系统。大多数研究都是基于手动提取的功能，但是这种方法不仅需要大量的人工成本，而且还会丢失原始数据中的很多信息，从而导致判断准确性低并且无法在实际情况下部署。本文开发了一种基于深度学习的入侵检测系统DL-IDS，该系统使用卷积神经网络（CNN）和长短期存储网络（LSTM）的混合网络来提取网络流量数据的时空特征并提供更好的入侵检测系统。为了减少模型训练样本中不同攻击类型的样本数量不均衡对模型性能的影响，DL-IDS使用类别权重优化方法来提高鲁棒性。最后，DL-IDS在CICIDS2017上进行了测试，CICIDS2017是可靠的入侵检测数据集，涵盖所有常见的，更新的入侵和网络攻击。在多分类测试中，DL-IDS的总体准确率达到98.67％，每种攻击类型的准确率均超过99.50％。