A Light-Weighted Model of GRU plus CNN Hybrid for Network Intrusion Detection

Typical network traffic is characterized by high-dimensional, polymorphic and massive amounts of data, which is a consistent challenge for pattern-based intrusion detection. Most detection models suffer from low efficiency and poor consideration of portability. We propose a light-weighted network intrusion detection model incorporating GRU and CNN as an equilibration of model complexity and performance. Firstly, we prune off redundant features from the dataset using extremely randomized trees. Then feature extraction is performed using GRU, taking into account the long-term and short-term dependencies in the data, and all hidden layer outputs are treated as the sequences of feature information for the next step. We construct a CNN model with structures including inversed residual, depthwise separable convolution and dilated convolution for spatial feature extraction. The model convergence is accelerated with a channel attention mechanism. We conduct experiments on the CIC-IDS2017 dataset and have verified the proposed with excellent detection performance, as well as the advantages of simplicity, such as fewer model parameters, smaller model size, less training time and faster detection.