# A Transfer Learning Approach for Network Intrusion Detection

arXiv: https://arxiv.org/abs/1909.02352 · HTML: https://mlsanity.com/paper/1909.02352/

## Key facts

- Cited by 6 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 5 Sep 2019.

## Built on by (most cited first, 6 of 6)

- [Deep transfer learning for intrusion detection in industrial control networks: A comprehensive review](https://mlsanity.com/paper/2304.10550/) (2023)
- [On Generalisability of Machine Learning-based Network Intrusion Detection Systems](https://mlsanity.com/paper/2205.04112/) (2022)
- [DI-NIDS: Domain Invariant Network Intrusion Detection System](https://mlsanity.com/paper/2210.08252/) (2022)
- [Effective Intrusion Detection in Highly Imbalanced IoT Networks with Lightweight S2CGAN-IDS](https://mlsanity.com/paper/2306.03707/) (2023)
- [Learning to Detect: A Data-driven Approach for Network Intrusion Detection](https://mlsanity.com/paper/2108.08394/) (2021)
- [PWG-IDS: An Intrusion Detection Model for Solving Class Imbalance in IIoT Networks Using Generative Adversarial Networks](https://mlsanity.com/paper/2110.03445/) (2021)

## Abstract (arXiv)

Convolution Neural Network (ConvNet) offers a high potential to generalize input data. It has been widely used in many application areas, such as visual imagery, where comprehensive learning datasets are available and a ConvNet model can be well trained and perform the required function effectively. ConvNet can also be applied to network intrusion detection. However, the currently available datasets related to the network intrusion are often inadequate, which makes the ConvNet learning deficient, hence the trained model is not competent in detecting unknown intrusions. In this paper, we propose a ConvNet model using transfer learning for network intrusion detection. The model consists of two concatenated ConvNets and is built on a two-stage learning process: learning a base dataset and transferring the learned knowledge to the learning of the target dataset. Our experiments on the NSL-KDD dataset show that the proposed model can improve the detection accuracy not only on the test dataset containing mostly known attacks (KDDTest+) but also on the test dataset featuring many novel attacks (KDDTest-21) -- about 2.68% improvement on KDDTest+ and 22.02% on KDDTest-21 can be achieved, as compared to the traditional ConvNet model.