Multi-Classification Decision Fusion Based on Stacked Sparse Shrink AutoEncoder and GS-Tabnet for Network Intrusion Detection

With the rapid development of the Internet, various network invasive behaviors are increasing rapidly. This seriously threatens the economic development of individuals, enterprises, and society. Network intrusion detection is important in network security systems, which can be regarded as a classification problem. It aims to distinguish between the specific categories of various network behaviors and determine whether the behavior belongs to network intrusion. However, network intrusions present a diverse and fast-changing trend, making categorizing difficult. Due to feature redundancy, uneven distribution of sample numbers, and inefficient parameter optimization, traditional rule-based approaches fail to achieve satisfying classification accuracy. This work proposes a multi-classification intrusion detection model based on Stacked Sparse Shrink AutoEncoder (SSSAE), Genetic Simulated annealing-based particle swarm optimization optimized Tabnet classifier (GS-Tabnet), and Decision Fusion (DF), called for SGTD short. Among them, SSSAE extracts multiple feature sets from the input data. Then GS-Tabnet trains a classifier for each feature set. Finally, the decision fusion fuses the results from these classifiers to obtain the final classification result. SGTD is compared with eight multi-classification benchmark models, and its intrusion detection accuracy is superior to its peers.