# 1D CNN Based Network Intrusion Detection with Normalization on Imbalanced Data

arXiv: https://arxiv.org/abs/2003.00476 · HTML: https://mlsanity.com/paper/2003.00476/

## Key facts

- Cited by 6 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 1 Mar 2020.

## Built on by (most cited first, 6 of 6)

- [Explainable Intrusion Detection Systems (X-IDS): A Survey of Current Methods, Challenges, and Opportunities](https://mlsanity.com/paper/2207.06236/) (2022)
- [Feature Extraction for Machine Learning-based Intrusion Detection in IoT Networks](https://mlsanity.com/paper/2108.12722/) (2021)
- [Anomaly Detection for Scenario-based Insider Activities using CGAN Augmented Data](https://mlsanity.com/paper/2102.07277/) (2021)
- [CAV-AD: A Robust Framework for Detection of Anomalous Data and Malicious Sensors in CAV Networks](https://mlsanity.com/paper/2407.05461/) (2024)
- [Aeroengine performance prediction using a physical-embedded data-driven method](https://mlsanity.com/paper/2407.00501/) (2024)
- [Threat Detection in Social Media Networks Using Machine Learning Based Network Analysis](https://mlsanity.com/paper/2601.02581/) (2026)

## Abstract (arXiv)

Intrusion detection system (IDS) plays an essential role in computer networks protecting computing resources and data from outside attacks. Recent IDS faces challenges improving flexibility and efficiency of the IDS for unexpected and unpredictable attacks. Deep neural network (DNN) is considered popularly for complex systems to abstract features and learn as a machine learning technique. In this paper, we propose a deep learning approach for developing the efficient and flexible IDS using one-dimensional Convolutional Neural Network (1D-CNN). Two-dimensional CNN methods have shown remarkable performance in detecting objects of images in computer vision area. Meanwhile, the 1D-CNN can be used for supervised learning on time-series data. We establish a machine learning model based on the 1D-CNN by serializing Transmission Control Protocol/Internet Protocol (TCP/IP) packets in a predetermined time range as an invasion Internet traffic model for the IDS, where normal and abnormal network traffics are categorized and labeled for supervised learning in the 1D-CNN. We evaluated our model on UNSWNB15 IDS dataset to show the effectiveness of our method. For comparison study in performance, machine learning-based Random Forest (RF) and Support Vector Machine (SVM) models in addition to the 1D-CNN with various network parameters and architecture are exploited. In each experiment, the models are run up to 200 epochs with a learning rate in 0.0001 on imbalanced and balanced data. 1D-CNN and its variant architectures have outperformed compared to the classical machine learning classifiers. This is mainly due to the reason that CNN has the capability to extract high-level feature representations that represent the abstract form of low-level feature sets of network traffic connections.