TSDL: A Two-Stage Deep Learning Model for Efficient Network Intrusion Detection

TLDR

Network intrusion detection systems are essential for protecting computer networks, yet many recent techniques struggle to recognize continuously emerging threats. This paper introduces TSDL, a two‑stage deep learning model that uses a stacked auto‑encoder and soft‑max classifier to efficiently detect intrusions. TSDL first classifies traffic as normal or abnormal using a probability score, then incorporates that score as a feature in a second stage that distinguishes normal traffic from various attack types, learning representations from large unlabeled datasets and evaluated on KDD99 and UNSW‑NB15. Experiments show TSDL surpasses existing methods, achieving 99.996 % accuracy on KDD99 and 89.134 % on UNSW‑NB15, positioning it as a future benchmark for deep‑learning‑based network security.

Abstract

The network intrusion detection system is an important tool for protecting computer networks against threats and malicious attacks. Many techniques have recently been proposed; however, these face significant challenges due to the continuous emergence of new threats that are not recognized by existing systems. In this paper, we propose a novel two-stage deep learning (TSDL) model, based on a stacked auto-encoder with a soft-max classifier, for efficient network intrusion detection. The model comprises two decision stages: an initial stage responsible for classifying network traffic as normal or abnormal, using a probability score value. This is then used in the final decision stage as an additional feature, for detecting the normal state and other classes of attacks. The proposed model is able to learn useful feature representations from large amounts of unlabeled data and classifies them automatically and efficiently. To evaluate its effectiveness, several experiments are conducted on two public datasets, specifically the benchmark KDD99 and UNSW-NB15 datasets. Comparative simulation results demonstrate that our proposed model significantly outperforms existing approaches, achieving high recognition rates, up to 99.996% and 89.134%, for the KDD99 and UNSW-NB15 datasets respectively. We conclude that our model has the potential to serve as a future benchmark for the deep learning and network security research communities.