HNN: A Novel Model to Study the Intrusion Detection Based on Multi-Feature Correlation and Temporal-Spatial Analysis

Network intrusion poses a severe threat to the Internet. Intrusion detection methods based on deep learning are very effective to process and analyze intrusion data. On the one hand, they use the Convolutional Neural Network (CNN) and Long Short Term Memory (LSTM) models to extract spatial and temporal features, respectively. However, they either adopt a single model or operate two models in series. And it fails to capture temporal-spatial features effectively. On the other hand, previous methods do not consider the multi-feature correlation of intrusion data. And then they cannot get better classification performance. To address the two above problems, we propose a hybrid neural network (HNN) model by integrating multi-feature correlation and temporal-spatial analysis. First, we adopt a contribution-based feature selection. Second, we reconstruct multi-feature correlation and then apply the CNN and LSTM in parallel to extract temporal-spatial features. Finally, we splice the temporal-spatial features with the correlation features, or study the influence of the temporal-spatial features by attention mechanism. Based on the above operations, we exploit the Deep Neural Network (DNN) to detect intrusion data. The experimental results show that HNN improves 3.78%, 1.31%, 0.21%, and 1.13% accuracy on the UNSW-NB15, AWID, CICIDS 2017, and CICIDS 2018 datasets.