Abstract: In view of the problems of the existing intrusion detection methods, such as poor feature extraction, low classification accuracy, and weak generalization ability, this paper proposes an intrusion detection model named MultiScale SpatialTemporal Residual Network(MSSTRNet)that integrates multiscale convolutional network (CNN), long shortterm memory network (LSTM), and residual network. Log1p smoothing is first applied to transform the data with large skewness, and this paper proves its effectiveness by comparing the correlation with the label before and after transformation and visualizing the data distribution. Then, the spatial and temporal features of the data are extracted by a multiscale onedimensional convolution module and a long shortterm memory module respectively. Finally, based on the idea of residual network, identity mapping is added to avoid gradient disappearance, gradient explosion and network degradation. The experimental results on the UNSW_NB15 dataset show that the proposed method can effectively enhance the representation ability and generalization ability of the model, and the performance of evaluation metrics has been significantly improved.

Key words: network intrusion detection, deep learning, Multi-scale convolutional neural network, long short term memory model, Residual network

摘要： 针对现有的入侵检测方法存在特征提取不佳、分类准确率低、泛化能力不强等问题，提出一种融合多尺度卷积神经网络、长短期记忆网络和残差网络的入侵检测模型(multiscale spatialtemporal residual network, MSSTRNet).首先，借助log1p平滑处理对偏度较大的数据进行转化，通过转化前后与标签的相关性对比以及数据分布可视化证明其有效性；其次，分别通过多尺度1维卷积模块和长短期记忆模块提取数据的空间特征和时序特征并进行特征融合；最后，基于残差网络的思想添加恒等映射，避免梯度消失、梯度爆炸以及网络退化等问题.在数据集UNSW_NB15上的实验结果表明，所提方法可以有效增强模型的表征能力以及泛化能力，且各项指标性能有比较明显的提升.

关键词: 网络入侵检测, 深度学习, 多尺度卷积神经网络, 长短期记忆网络, 残差网络