Abstract: As the number of network attacks increases, network intrusion detection systems are becoming increasingly important in maintaining network security. Most studies have used deep learning approaches for network intrusion detection but have not fully utilized the features of traffic from multiple perspectives. Additionally, these studies often suffer from the use of outdated experimental datasets. In this paper, a parallelstructured DSCInceptionBiLSTM network is proposed to evaluate the designed network model using stateoftheart datasets. The model consists of two branches, network traffic image, and text anomaly traffic detection. Spatial and temporal features of traffic are extracted by improved convolutional neural networks and recurrent neural networks, respectively. Finally, network intrusion detection is achieved by fusing spatiotemporal features. The experimental results show that our model achieves 99.96%, 99.19%, and 99.95% accuracy on the three datasets of CICIDS 2017, CSECICIDS 2018 and CICDDoS 2019, respectively, effectively classifying the anomalous traffic with high precision and meeting the requirements of intrusion detection system.

Key words: network intrusion detection, deep learning, feature fusion, depthwise separable convolution, Inception

摘要： 随着网络攻击日益增多，网络入侵检测系统在维护网络安全方面也越来越重要.目前多数研究采用深度学习的方法进行网络入侵检测，但未充分从多个角度利用流量的特征，同时存在实验数据集过于陈旧的问题.提出了一种并行结构的DSCInceptionBiLSTM网络，使用最新的数据集评估所设计的网络模型.该模型包括网络流量图像和文本异常流量检测2个分支，分别通过改进的卷积神经网络和循环神经网络提取流量的空间特征和时序特征.最后通过融合时空特征实现网络入侵检测.实验结果表明，在CICIDS2017,CSECICIDS2018,CICDDoS2019这3个数据集上，该模型分别达到了99.96%,99.19%,99.95%的准确率，能够对异常流量进行高精度分类，满足入侵检测系统的要求.

关键词: 网络入侵检测, 深度学习, 特征融合, 深度可分离卷积, Inception