# A Content-Based Deep Intrusion Detection System

arXiv: https://arxiv.org/abs/2001.05009 · HTML: https://mlsanity.com/paper/2001.05009/

## Key facts

- Cited by 3 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 14 Jan 2020.

## Built on by (most cited first, 3 of 3)

- [An Adaptable Deep Learning-Based Intrusion Detection System to Zero-Day Attacks](https://mlsanity.com/paper/2108.09199/) (2021)
- [Preliminary study on artificial intelligence methods for cybersecurity threat detection in computer networks based on raw data packets](https://mlsanity.com/paper/2407.17339/) (2024)
- [Intelligence-Guided Adaptive Purification for DDoS-Resilient Quantum Networks: A CUDA-Q based Study](https://mlsanity.com/paper/2607.16276/) (2026)

## Abstract (arXiv)

The growing number of Internet users and the prevalence of web applications make it necessary to deal with very complex software and applications in the network. This results in an increasing number of new vulnerabilities in the systems, and leading to an increase in cyber threats and, in particular, zero-day attacks. The cost of generating appropriate signatures for these attacks is a potential motive for using machine learning-based methodologies. Although there are many studies on using learning-based methods for attack detection, they generally use extracted features and overlook raw contents. This approach can lessen the performance of detection systems against content-based attacks like SQL injection, Cross-site Scripting (XSS), and various viruses. In this work, we propose a framework, called deep intrusion detection (DID) system, that uses the pure content of traffic flows in addition to traffic metadata in the learning and detection phases of a passive DNN IDS. To this end, we deploy and evaluate an offline IDS following the framework using LSTM as a deep learning technique. Due to the inherent nature of deep learning, it can process high dimensional data content and, accordingly, discover the sophisticated relations between the auto extracted features of the traffic. To evaluate the proposed DID system, we use the CIC-IDS2017 and CSE-CIC-IDS2018 datasets. The evaluation metrics, such as precision and recall, reach 0.992 and 0.998 on CIC-IDS2017, and 0.933 and 0.923 on CSE-CIC-IDS2018 respectively, which show the high performance of the proposed DID method.