Network intrusion detection using fusion features and convolutional bidirectional recurrent neural network

In this paper, novel fusion features to train Convolutional Bidirectional Recurrent Neural Network (CBRNN) are proposed for network intrusion detection. UNSW-NB15 data sets' attack behaviours (input features) are fused with their first and second-order derivatives at different stages to get fusion features. In this work, we have taken architectural advantage and combine both Convolutional Neural Network (CNN) and bidirectional Long Short-Term Memory (LSTM) as Recurrent Neural Network (RNN) to get CBRNN. The input features and their first and second-order derivatives are fused and considered as input to CNN and this fusion is known as early fusion. Outputs of the CNN layers are fused and used as input to the bidirectional LSTM, this fusion is known as late fusion. Results show that late fusion features are more suitable for intrusion detection and outperform the state-of-the-art approaches with average recognition accuracies of 98.00% and 91.50% for binary and multiclass classification configurations, respectively.