Intrusion Detection Based on Convolutional Neural Network in Complex . . .
235
Table 2. Details of KDDCUP’99 data set
Data type
Full set
Train set Test set
Normal
972,781
97,278
60,593
Dos
3,883,370 391,458 223,298
Probing
41,102
4107
2377
R2L (Remote to Local) 1126
1126
5993
U2R (User to Root)
52
52
39
Total
4,898,431 494,021 292,300
3 Experimental Results and Analysis
In order to verify the actual detection effect of the proposed CNN model, this
paper implements the code based on TensorFlow to test KDDCUP’99 data set.
The details of KDDCUP’99 data set are shown in Table 2.
Firstly, this paper designs experiments to compare the performance of different activation functions on the proposed model. Secondly, the optimal activation functions are selected to complete the whole model. Then, we design a
five-category experiment to test the performance of the proposed method for
intrusion detection.
There are two layers in the proposed CNN model that need to use activation
functions: the first fully connected layer and the convolutional layer. Figure 4
shows the performance of the proposed model using different activation functions
in the first fully connected layer. It can be found that tanh not only converges
faster than other functions but also has the highest accuracy.
Fig. 4. Performance comparison of different activation functions in the first fully connected layer: a the result of the model’s 40-step iteration, b the result of the model’s
200-step iteration