Need detailed Paper on the Following Topic....format should be in IEEE Format

SPECIAL SECTION ON SECURITY AND PRIVACY IN EMERGING DECENTRALIZED COMMUNICATION ENVIRONMENTS

Received May 29, 2019, accepted June 15, 2019, date of publication June 19, 2019, date of current version July 9, 2019.

Digital Object Identifier 10.1109/ACCESS.2019.2923814

Combined Wireless Network Intrusion Detection Model Based on Deep Learning HONGYU YANG , GENG QIN, AND LI YE School of Computer Science and Technology, Civil Aviation University of China, Tianjin 300300, China

Corresponding author: Hongyu Yang ([email protected])

This work was supported by the Civil Aviation Joint Research Fund Project of the National Natural Science Foundation of China under Grant U1833107.

ABSTRACT In order to effectively detect wireless network intrusion behavior, a combined wireless network intrusion detection model based on deep learning was proposed. First, a feature database was generated by feature mapping, one-hot encoding, and normalization processing. Then, we built a deep belief network (DBN) with the multi-restricted Boltzmann machine (RBM) and the back propagation (BP) network. The BP network layer was connected as an auxiliary layer to the end of the RBM. The back- propagation algorithm was used to fine-tune the weight of the multi-restricted Boltzmann machine. Finally, the support vector machine (SVM) was used to train the detection method. After training, the intrusion detection model, which had the DBN-SVM detection method, was determined. The experimental results show that the detection model has good intrusion detection performance.

INDEX TERMS Intrusion detection, information security, wireless network, deep belief network, support vector machine.

I. INTRODUCTION With the development of wireless network and computer technology, wireless network intrusion tends to be frequent. In the face of Cyberattack with the features of high conceal- ment, large scale, and easy to spread, the traditional intrusion detection methods [1]–[4] have limitations in detection accu- racy rate and precision rate. Therefore, it is urgent to propose a more accurate and efficient intrusion detection method to improve the intrusion detection capability in the wireless network environment.

At present, deep learning is currently used in many areas such as medical, autonomous driving, image recognition and natural language processing [5]–[9]. Using machine learning methods to improve the effectiveness and accuracy rate of intrusion detection has become a research hotspot in the field of wireless network security. Zhang et al. [10] analyzed the wired equivalent privacy (WEP) attack datasets in the wireless network, but they did not do intrusion detection experiments. Yadav and Subramanian [11] and Li et al. [12] proposed an intrusion detection method for DDOS, which can accurately and quickly detect DDOS attacks, but it is limited

The associate editor coordinating the review of this manuscript and approving it for publication was Xiaochun Cheng.

to specific attack types. Kotpalliwar and Wajgi [13] and Cai and Wang [14] proposed an intrusion detection method that combined with principal component analysis (PCA) and other technologies, but it has a high algorithmic complex- ity. In order to reduce the complexity of the algorithm, Zhao et al. [15] proposed an intrusion detection method based on DBN and probabilistic neural network, but it can be only used in the wireless network that has few layers. Majjed et al. [16] proposed a learning method based on autonomous learning framework, which reduced the time on training and testing, but its classification accuracy rate was not high. Wang et al. [17] proposed a dual SVM model, although the classification accuracy rate was improved, but it was difficult to quickly select the appropriate parameters. Li et al. [18] used the deep self-coding network as the feature extractor, combined with the Softmax classifier to detect the intrusion behavior, but the human factors affected the real results. Sun et al. [19] A method of improving Bayesian network intrusion detection based on deep learning and slid- ing window was proposed to solve the problem of attribute redundancy in training dataset. Nevertheless, it is difficult to cope with high-dimensional network data. Gao etal. [20] pro- posed a multi-class support vector machine intrusion detec- tion (DBN-MSVM) method based on the deep belief network

82624 This work is licensed under a Creative Commons Attribution 3.0 License. For more information, see http://creativecommons.org/licenses/by/3.0/ VOLUME 7, 2019

H. Yang et al.: Combined Wireless Network Intrusion Detection Model Based on Deep Learning

was proposed, which can effectively solve the classification problem of massive intrusion data. However, its detection performance needs to be improved.

Due to the insufficient detection of wireless network intru- sion efficiency and accuracy in the above research, a com- bined wireless network intrusion detection model based on deep learning was proposed. We used DBN as the feature extraction layer and SVM as the classification layer. In the DBN layer, the contrast divergence algorithm and the error back propagation algorithm were used to reduce data dimen- sions and extract features. It helped SVM to improve the ability to classify high-dimensional data. Compared with the previous forward propagation, this paper adjusted the weight of the multi-restricted Boltzmann machine (RBM) with the back-propagation algorithm. The detection model was trained and established with the support vector machine (SVM) to continue to improve the intrusion.

FIGURE 1. The flow chart of the intrusion detection.

II. DETECTION MODEL The intrusion detection model is consisted of the data acqui- sition module, the data pretreatment module, the data analy- sis module and the detection classification module. Figure 1 shows the processing flow of the intrusion detection model. ModuleOne(DataAcquisition): The appropriate data set is

selected from the wireless network and saved into the source database.

ModuleTwo(Datapretreatment):First, the data are filtered and sampled in the source database. Then, the filtered data are subjected to feature mapping, characterized feature digitiza- tion and normalization, thereby generating a feature database. Module Three (Data Analysis): First, we use 80% of the

feature database as the training data set, and the rest as the test data set.

Then, the detection model is trained by supervised or unsu- pervised method. Finally, the detection method and parame- ters that meet the indicator are determined. Module Four (Detection Classification): Perform classi-

fication detection, handle anomalies data and store in the anomalies database.

A. DATA ACQUISITION MODULE The data acquisition module associates the data set with the abstract theory learning method. The specific steps of the module were designed as follows: Step 1: Data set selection. The appropriate data set was

chosen. Step 2: Data collection. The data set was gathered and read

by Python’s Scapy library. Step 3: Timestamp tag. The data set was added a timestamp

by Python’s time module.

B. DATA PRETREATMENT MODULE Data pretreatment module deals with the collected data and generates a feature database. The specific steps of the module were designed as follows: Step1: Filtering and Sampling. Missing and redundant data

were filtered and sampled in the source database. Step 2: Feature mapping. A feature set was defined

according to the existing wireless network intrusion, and the data from the source database was mapped to a predefined feature set. Step 3: Character feature digitization. The characteris-

tic features were converted to numerical features with the One-Hot Encoding. Step 4: Normalized. The raw data was dropped into the

[0,1] interval with the minimum-maximum normalization method.

x∗ = x −min

max−min (1)

where x is a feature state value, min and max are the minimum and maximum values of the feature, and x∗ is the normalized feature state value.

C. DATA ANALYSIS MODULE The data analysis module determines the intrusion detection model and its parameters by repeated training and weight adjustment. The specific steps of the module were designed as follows: Step 1: The data set was built. The feature database was

divided into a training feature set and a testing feature set.

VOLUME 7, 2019 82625

H. Yang et al.: Combined Wireless Network Intrusion Detection Model Based on Deep Learning

Step 2: The feature learning method was selected. This paper chose the combined intrusion detection method for combining deep belief network (DBN) and support vector machine (SVM). Step 3: Feature learning. The selected feature learning

method was trained by the training feature set, and the weight of the multi-restricted Boltzmann machine (RBM) was fine- tuned by the back-propagation algorithm. Step 4: Performance evaluation. The intrusion detection

algorithm was trained by the support vector machine (SVM), and the learning process was stopped when the detection effect was good enough. The intrusion detection algorithm and the detection model at this time was provided to the detection classification.

D. DETECTION CLASSIFICATION MODULE The detection classification module uses the detection model, method and parameters that generated by training to carry out detection tasks. The specific steps of the module were designed as follows: Step 1: Classification detection. The data set was classified

and detected with the intrusion detection model. Step 2: Handle anomalies data. The anomalies data was

processed and stored in the anomalies database.

III. COMBINED DETECTION METHOD A. OVERALL DESIGN The combined deep belief network structure is composed of a multi-layer RBM, a BP network layer, and a SVM clas- sification layer. The DBN consists of a multi-layered RBM and a BP network layer. Each RBM has the characteristics of no connection within the layer and thorough connection between layers. Adjacent RBM transfer the hidden layer data of the previous layer to the next layer of the visible layer. After learning, the hidden layer variables are treated as low- dimensional features of the visible layer high-dimensional data. The BP network layer acts as an auxiliary layer to fine- tune the weight. Connect the adjusted RBM to improve the SVM classification capability. The specific structural design of the network is as shown in Figure 2.

1) Multi-layer RBM structure: The feature extraction layer is constructed with a plurality of stacked unsupervised RBM shallow networks.

2) BP network layer: The BP network layer is connected to the end of the RBM structure, as an auxiliary layer to fine- tuning the weight of the network parameters.

3) SVM classification layer: After fine-tuning the weight, the output of the last-layer RBM is the dimensionality reduc- tion feature, and access it to the SVM classification layer. The sequence minimum optimization algorithm is used for supervised learning and classifying.

The process of the combined detection method was mainly divided into four stages. It can be seen in Figure 3.

1) Pretreatment stage: First, feature mapping maps the training data set to the corresponding feature field. Then, the

FIGURE 2. Combined deep belief network structure.

characteristic features are converted to numerical features by One-Hot Encoding. Finally, unify the dimensions and magnitudes between different features.

2) DBN training stage: First, RBM was pre-trained layer by layer through the contrastive divergence algorithm in an unsupervised way. The weight of the RBM is fine-tuned with the tag of the training data set and the back-propagation algorithm.

3) SVM training stage: First, the SVM parameters were configured. Then, SVM was trained through the sequence minimum optimization algorithm.

4) Testing stage: First, the detection method was subjected to the test data set. Then, performance evaluation indica- tors were calculated: accuracy rate, precision rate, recall rate, and F1. When the indicator reaches the expected level, the learning process would be ended, if it is not reached, it returns to the stage 2) to restart the training.

B. DEEP BELIEF NETWORK DBN is a generation model with numerous hidden variable layers that composed of multi-layer unsupervised learning RBM and a supervised back propagation neural network layer.

RBM is an undirected probability graph model includes one layer of visible variables and one layer of hidden vari- ables. H denotes the hidden layer; v denotes the visible layer. Suppose the number of visible layer variables is nv, the num- ber of hidden layer variables is nh, and both nv and nh are natural numbers. v = [v1,v2, . . . ,vnv]T denotes visual layer

82626 VOLUME 7, 2019

H. Yang et al.: Combined Wireless Network Intrusion Detection Model Based on Deep Learning

FIGURE 3. The flow chart of the combined detection method.

variable set; h = [h1,h2, . . . ,hnh]T denotes hidden layer variable set. The energy function is E(v, h|θ).

E(v,h|θ) =−bTv− cTh− vTWh (2)

where b denotes the visible layer offset; c denotes the hidden layer offset; W denotes the weight matrix with the visible layer and the hidden layer.

The visible layer activation probability P(vi = 1|h, θ) and the hidden activation probability P(hj = 1|v, θ) can be derived with the symmetric structure of RBM and the independent characteristics of activation conditions.

P(vi = 1|h,θ) = σ(bi + ∑ j

Wijhj) (3)

P(hj = 1|v,θ) = σ(cj + ∑ j

Wijvi) (4)

The purpose of learning RBM is to find the appropriate parameter θ = [W,b,c] to minimize the energy function E(v, h|θ). We chose the contrastive divergence (CD) algo- rithm proposed in paper [21] to learn RBM until the appro- priate parameter θ was found.

C. SUPPORT VECTOR MACHINE The SVM is based on the maximization of interval, and its purpose is to find a hyperplane that correctly classifies the data. Suppose there is a set of linearly separated training sam- ple T = {(x1,y1), (x2,y2), . . . ,(xi,yi)}, where xi denotes the data, and yi takes the value −1 or 1, xi and yi denote the ith feature vector and label. A unique hyperplane and a classification decision function f(x) is obtained.

w∗ · x +b∗ = 0 (5)

f (x) = sign(w∗ · x +b∗) (6)

yi(w∗ ·x +b∗) denotes the confidence of the SVM classifi- cation, and ri denotes the geometric spacing of points (xi,yi) to the hyperplane.

ri = yi( w∗

||w∗|| · xi +

b∗

||w∗|| ) (7)

The linear programming with maximum geometric interval of sample set is got through the interval transformation and lagrange dual algorithm.

min α

1 2

n∑ i=1

n∑ j=1

αiαjyiyj(xi · xj)− n∑ i=1

αi

s.t. n∑ i=1

αiyi = 0

αi ≥ 0, i = 1,2, · · · ,n (8)

Due to the presence of anomalies, not all samples can satisfy the interval linear maximization constraint. Therefore, introducing a slack variable ξi to change the constraint.

yi(w ∗ · x +b∗) ≥ 1− ξi (9)

However, the number of misclassifications also needs to be constrained, so the penalty parameter C is introduced to change the objective function.

1 2 ||w∗||2 +C

n∑ i=1

ξi (10)

When solving the classification problem of wireless net- work samples, it can not simply classify them with linear functions. This paper introduced kernel functions to put data into a high-dimensional space where data can be divided. The optimal partition can be found in this space. For the input space X of the original data and the transformed feature space Z, it is assumed that there is a mapping φ : X → Z such that for all xi, yi satisfy K(xi,yi) = φ(xi) · φ(yi), and K(xi,yi) is a kernel function. The final decision function f (x) is obtained.

f (x) = sign( n∑ i=1

α ∗ i yiK(x · xi)+b

∗) (11)

VOLUME 7, 2019 82627

H. Yang et al.: Combined Wireless Network Intrusion Detection Model Based on Deep Learning

FIGURE 4. DBN error curves for different network depths.

TABLE 1. Detection performance for different network depths.

IV. EXPERIMENTS AND RESULTS A. EXPERIMENTAL ENVIRONMENT Hardware environment: MacBook Pro, Intel Core i5 CPU @ 2.6GHz, 8GB RAM.

Software environment: macOS High Sierra, Python. Data set: Since the number of samples obtained from the

real wireless network is very limited, we selected NSL-KDD as the detection data set in the experiment.

The NSL-KDD data set consists of 125,973 training data and 22,543 test data. Each data contains 41 common network features, of which 38 are continuous numerical features and 3 are discrete character features. In addition, each piece of data is well marked as normal or abnormal, involving a total of 22 types of intrusion, mainly divided into four categories: DOS, R2L, U2R, PROBE. The NSL-KDD data set has the characteristics of large data volume, rich intrusion behavior and authoritative sample source.

B. DATA PRETREATMENT For the convenience of simulation experiment, NSL-KDD needs to be pretreated. The specific steps were designed as follows: Step 1: Read the data set file in DataFrame format with

Python’s Pandas library, and correspond each item in the original data to the feature field, and separated the feature data from the tag data. Step 2: Encoded the 〈protocol_type〉, 〈service〉, and 〈flag〉

features of the data with One-Hot Encoder class in the Scikit-learn library.

Step 3: Normalized numeric features with the MinMaxS- caler class in the Scikit-learn library.

C. IMPACT OF NETWORK DEPTH Experimental purpose: Verify and analyze the impact of net- work depth on DBN. The experimental steps were designed as follows: Step 1: The NSL-KDD data set was pretreated. Step 2: Five different numbers of DBNs were config-

ured with uniform node spacing. The number of nodes in different levels was 122-12, 122-67-12, 122-85-48-12, 122-95-68-41-12, 122-100-78-56-34. Step 3: First, RBM was trained unsupervised layer by layer

with the contrastive divergence algorithm. Then, the net- work weights were fine-tuned with the Back-propagation algorithm. Step 4: The trained model was evaluated with the

NSL-KDD test set. The RBM reconstruction error and BP network error curve

of DBN with different network layers in the training process are shown in Figure 4. Figure 4(a) shows the change of RBM reconstruction error with the number of iterations from 1-layer to 5-layer DBN. Figure 4(b) corresponds to the BP network error of each DBN with the number of iterations. The error curve reflects that the learning algorithm has a good DBN training effect, and the training effect is better as the number of network layers increases.

The DBN detection performance of different network depths is shown in Table 1. As the network depth increases,

82628 VOLUME 7, 2019

H. Yang et al.: Combined Wireless Network Intrusion Detection Model Based on Deep Learning

FIGURE 5. Detection performance box graph of different kernel functions.

the classification capability generally shows an upward trend. The 4-layer DBN has the highest scores. Although the accu- racy rate is lower than 5-layer DBN, but the F1 is higher than 5- layer DBN. Therefore, in this paper, the DBN was set to 4-laye.

D. IMPACT OF KERNEL FUNCTION Experimental purpose: To verify and analyze the influence of the kernel function with the DBN-SVM combined detection method proposed in the 4-layer DBN condition. The experi- mental steps were designed as follows: Step 1: The NSL-KDD data set was read and preprocessed. Step 2: Based on the 4-layer DBN model, the output of the

last-layer RBM is calculated as a dimensionality reduction representation of the feature. Step 3: SVM was set to different kernel functions: linear

kernel, polynomial kernel, Sigmoid kernel, Rbf kernel. Linear kernel function penalty parameter C and error precision Tol were taken each group of 10, a total of 100 groups for grid search. Polynomial kernel function considered the case of dimensions 2, 3, and 4, taking the coefficient γ and the constant term Coef0 for 10 groups of 100 to perform grid search; Similarly, Sigmoid kernel function with coefficient γ and constant term Coef0 were 100 groups; Rbf kernel function with penalty parameter C and coefficient γ were 100 groups. Step 4: The configured SVM model was trained and eval-

uated on the test set. The box plot for detection performance of different kernel

functions is shown in Figure 5. As the result of Figure 5(a) and (b), the detection result obtained by using the Sigmoid kernel function and the polynomial kernel function is the most unstable, and the detection effect varies considerably with the parameter. The detection result with the linear kernel function is the most stable, but the detection effect is not much different from the case of DBN. The RBF kernel function can make the model have a good test result, and the upper limit is higher when the parameters are properly configured.

Therefore, the RBF kernel function was selected, and it was used to put the data in a high-dimensional space in which data

can be divided. Then, the DBN-SVM model of multiple sets with RBF kernel function was configured and evaluated.

The distribution of accuracy rate and F1 with the relevant research parameters in each group of experiments is shown in Figure 6. It can be seen from Figure 6(a)-(d) that the influence of each parameter on the accuracy rate and the F1 is almost the same. With increase of the penalty parameter C and the kernel function coefficient γ , the detection effect of the combined detection method becomes better. The accuracy rate and the F1 exceed 0.98. The error precision Tol has less effect on the detection effect.

According to the analysis of network depth and kernel function, the combined detection method selected 4-layer DBN as the feature extraction layer and SVM with RBF kernel as the classification layer.

After training and determining feature mapping layer and the classification layer, the NSL-KDD data set detec- tion experiment was performed, and the detection perfor- mance results of the combined detection method are shown in Table 2, and the ROC curve is shown in Figure 7.

It can be seen from Table 2 and Figure 7. After the param- eter optimization, the detection method in this paper is ideal, and its accuracy rate, recall rate, precision rate and F1 are all over 0.98. The value of ROC curve area exceeds 0.99, which indicates that the combined detection method has a good performance in detection and classification.

E. IMPACT OF TRAINING DATA VOLUME Experimental purpose: Verify and analyze the training time, test time and detection performance of the detection method under different training data volume. The experimental steps were designed as follows: Step 1: The DBN-SVM model was trained by sampling

20%, 40%, 60%, and 80% of the NSL-KDD training set. Their composition is shown in Table 3. Step 2: The detection model was evaluated with the test-

ing set. The relationship between training and test time varies with

the amount of training data as shown in Figure 8. The DBN spends more time during the training process, and the SVM

VOLUME 7, 2019 82629

H. Yang et al.: Combined Wireless Network Intrusion Detection Model Based on Deep Learning

FIGURE 6. Heatmap under RBF kernel parameters.

TABLE 2. Detection performance results.

FIGURE 7. ROC curve.

takes more time during the testing process. The accuracy rate and F1 vary with the amount of training data as shown in Figure 9. Compared with DBN, the detection method sac- rifices part of the detection time, but it improves the detection performance.

TABLE 3. NSL-KDD data composition.

F. COMPARISON OF DIFFERENT DETECTION METHODS Experimental purpose: Analyze the advantages of the detec- tion method for WEP attack data set with different detection methods. Detection methods include SVM method, DBN method and PCA-SVM method. The WEP attack data set can extract the following features: WEP attack traffic, wireless network connection, network traffic based on events, host network traffic. The experimental steps were designed as follows: Step 1: Two SVM models were constructed with the SVC

class of the Scikit-learn library, one for independent training and the other for training PCA dimensionality reduction data. The PCA model was constructed with the PCA class of the Scikit-learn library. Step 2: The SVC model established in step 1 was trained

with the training data set and the fit method. After the training was completed, the test data set was taken and tested the obtained SVC model with the prediction method.

82630 VOLUME 7, 2019

H. Yang et al.: Combined Wireless Network Intrusion Detection Model Based on Deep Learning

FIGURE 8. The relationship between the amount of training data and test time.

FIGURE 9. The relationship between training data volume, accuracy rate and F1.

Step 3: The PCA model was trained with the training data set and the fit method. After completing the training, the orig- inal training data after dimensionality reduction was obtained

with the transformation method, and the another SVC model established in step 2 was trained with this data. Take the test data set as input, and the PCA model was reduced the dimensionality with the transformation method and tested it with the SVC prediction method.

TABLE 4. The comparison results of different detection methods.

FIGURE 10. Performance comparison of different detection methods.

The comparison results of the four methods are given in Table 4, and the comparison of the detection performance is shown in Figure 10. It can be seen from Table 4 and Figure 10 that the method has good performance in terms of accuracy rate, recall rate, precision rate and F1.

It can be seen from Table 4 and Figure 10 that: (1) The classification accuracy rate of the SVM method is high, but the time and space complexity of the method increase with the increase of the training data amount. It is difficult to achieve good results when the high dimensional data sets are detected. (2) Feature mapping ability of the DBN method is good, but the accuracy rate is slightly low. (3) Although the PCA-SVM method reduces the dimensionality of the data set, the accuracy rate is not high. (4) The method of this paper is a DBN-SVM combined detection method. It uses DBN as the feature extraction layer and SVM as the classifier. On the one hand, this detection method makes up for the shortcomings that SVM is difficult to deal with high dimensional data sets, and on the other hand, it effectively improves the classifica- tion performance of DBN. Therefore, the accuracy rate, recall rate, precision rate and F1 of this method are better than the other three methods.

V. CONCLUSION In order to compensate for the insufficiency of detecting wire- less network intrusion efficiency and accuracy rate, a com- bined wireless network intrusion detection model based on

VOLUME 7, 2019 82631

H. Yang et al.: Combined Wireless Network Intrusion Detection Model Based on Deep Learning

deep learning was proposed. Through the experiments, it was determined that the 4-layer DBN was feature mapping layer, and the Rbf kernel SVM was the classification layer. The experimental results show that the detection model has better detection results.

The focus of future research is on how to improve the detection accuracy of the detection model in this paper since the sample size of the wireless network intrusion type is small.

REFERENCES [1] K. Kaynar, ‘‘A taxonomy for attack graph generation and usage in network

security,’’ J. Inf. Secur. Appl., vol. 29, no. 3, pp. 27–56, 2016. [2] Y. Li and G. Q. Huang, ‘‘Attack intention detection method based on

possible graph,’’ Comput. Eng. Sci., vol. 39, no. 4, pp. 698–707, 2017. [3] L. Zhang, Y. Cui, J. Liu, Y. Jiang, and J. P. Wu, ‘‘Application of machine

learning in network space security research,’’ J. Comput., vol. 41, no. 9, pp. 1943–1975, 2018.

[4] K. Nie, Q. L. Zhou, W. J. Zhu, and Z. Y. Zhang, ‘‘Three kinds of network attack modeling based on sequential logic,’’ Comput. Sci., vol. 45, no. 2, pp. 209–214, 2018.

[5] D. Shen, G. Wu, and H.-I. Suk, ‘‘Deep learning in medical image analysis,’’ Annu. Rev. Biomed. Eng., vol. 19, no. 1, pp. 221–248, 2017.

[6] H. L. Liu, T. Taniguchi, Y. Tanaka, K. Takenaka, and T. Bando, ‘‘Essential feature extraction of driving behavior using a deep learning method,’’ in Proc. IEEE Intell. Vehicles Symp., Seoul, South Korea, Jul. 2015, pp. 1054–1060.

[7] K. Grm, V. Štruc, A. Artiges, M. Caron, and H. K. Ekenel, ‘‘Strengths and weaknesses of deep learning models for face recognition against image degradations,’’ IET Biometrics, vol. 7, no. 1, pp. 81–89, Jan. 2018.

[8] Y. O. Lin, H. Lei, X. Y. Li, and J. Wu, ‘‘Deep learning in natural language processing: Methods and applications,’’ J. Univ. Electron. Sci. Technol., vol. 46, no. 6, pp. 913–919, 2017.

[9] X. F. Xi and G. D. Zhou, ‘‘Deep learning research for natural language processing,’’ J. Autom., vol. 42, no. 10, pp. 1445–1465, 2016.

[10] C. Zhang, L. Hu, and B. L. NuEr, ‘‘Analysis and implementation of WEP attack data set in wireless network,’’ J. Jilin Univ., Sci. Ed., vol. 52, no. 1, pp. 71–75, 2014.

[11] S. Yadav and S. Subramanian, ‘‘Detection of application layer DDoS attack by feature learning using stacked autoencoder,’’ in Proc. Int.Conf.Comput. Techn. Inf. Commun. Technol. (ICCTICT), New Delhi, India, Mar. 2016, pp. 361–366.

[12] C. H. Li, Z. J. Sun, X. Y. Yuan, X. L. Li, L. Gong, and W. M. Wang, ‘‘Real- time DDos attack detection based on deep learning,’’ Telecommun. Sci., vol. 33, no. 7, pp. 53–65, 2017.

[13] M. Kotpalliwar and R. Wajgi, ‘‘Classification of attacks using support vector machine (SVM) on KDDCUP’99 IDS database,’’ in Proc. 5th Int. Conf. Commun. Syst. Netw. Technol., Gwalior, India, Apr. 2015, pp. 987–990.

[14] S. Ding and G. Wang, ‘‘Research on intrusion detection technology based on deep learning,’’ in Proc. 3rd IEEE Int. Conf. Comput. Commun. (ICCC), Dec. 2017, pp. 1474–1478.

[15] G. Z. Zhao, C. X. Zhang, and L. J. Zheng, ‘‘Intrusion detection using deep belief network and probabilistic neural network,’’ in Proc. IEEE Int. Conf. Comput. Sci. Eng. (CSE) IEEE Int. Conf. Embedded Ubiquitous Comput. (EUC), Guangzhou, China, Jul. 2017, pp. 639–642.

[16] M. Al-Qatf, Y. Lasheng, M. Al-Habib, and K. Al-Sabahi, ‘‘Deep learning approach combining sparse auto-encoder with SVM for network intrusion detection,’’ IEEE Access, vol. 6, pp. 52843–52856, 2018.

[17] H. Wang, J. X. Hua, and X. S. Fan, ‘‘A dual SVM model based IDS scheme,’’ J. Shandong Univ. Eng. Ed., vol. 43, no. 6, pp. 53–56 and 64, 2013.

[18] C. L. Li, Y. J. Huang, H. Wang, and C. X. Niu, ‘‘A network intrusion detec- tion method based on deep learning,’’ Inf. Secur. Commun. Confidentiality, vol. 36, no. 10, pp. 68–71, 2014.

[19] H. L. Sun, W. H. Chen, and D. Z. Liu, ‘‘Improved Bayesian network intrusion detection algorithm based on deep learning,’’ Softw. Eng., vol. 22, no. 4, pp. 17–20 and 16, 2019.

[20] N. Gao, Y. Y. He, and L. Gao, ‘‘Deep learning method for intrusion detection in massive data environment,’’ Comput. Appl. Res., vol. 35, no. 4, pp. 1197–1200, 2018.

[21] G. E. Hinton, ‘‘Training products of experts by minimizing contrastive divergence,’’ Neural Comput., vol. 14, no. 8, pp. 1771–1800, 2002.

HONGYU YANG was born in Changchun, China, in 1969. He received the Ph.D. degree in computer science and technology from Tianjin University, China, in 2003. He is currently a Professor with the School of Computer, Civil Aviation University of China, Tianjin, China. His main research interest includes network information security.

GENG QIN was born in Tianjin, China, in 1992. He is currently pursuing the M.Eng. degree with the School of Computer, Civil Aviation University of China, Tianjin, China. His main research inter- est includes network information security.

LI YE was born in Hubei, China, in 1993. He is cur- rently pursuing the M.Eng. degree with the School of Computer, Civil Aviation University of China, Tianjin, China. His main research interest includes network information security.

82632 VOLUME 7, 2019