# Network Intrusion Detection based on LSTM and Feature Embedding

arXiv: https://arxiv.org/abs/1911.11552 · HTML: https://mlsanity.com/paper/1911.11552/

## Key facts

- Cited by 4 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 26 Nov 2019.

## Built on by (most cited first, 4 of 4)

- [On the Evaluation of Sequential Machine Learning for Network Intrusion Detection](https://mlsanity.com/paper/2106.07961/) (2021)
- [Class-Proportional Coreset Selection for Difficulty-Separable Data](https://mlsanity.com/paper/2507.10904/) (2025)
- [Sequential Deep Learning Architectures for Anomaly Detection in Virtual Network Function Chains](https://mlsanity.com/paper/2109.14276/) (2021)
- [Enhanced Feature Extraction for IoT Network Intrusion Detection Using GNNs and KAN](https://mlsanity.com/paper/2607.02981/) (2026)

## Abstract (arXiv)

Growing number of network devices and services have led to increasing demand for protective measures as hackers launch attacks to paralyze or steal information from victim systems. Intrusion Detection System (IDS) is one of the essential elements of network perimeter security which detects the attacks by inspecting network traffic packets or operating system logs. While existing works demonstrated effectiveness of various machine learning techniques, only few of them utilized the time-series information of network traffic data. Also, categorical information has not been included in neural network based approaches. In this paper, we propose network intrusion detection models based on sequential information using long short-term memory (LSTM) network and categorical information using the embedding technique. We have experimented the models with UNSW-NB15, which is a comprehensive network traffic dataset. The experiment results confirm that the proposed method improve the performance, observing binary classification accuracy of 99.72%.