{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,5,8]],"date-time":"2026-05-08T16:49:49Z","timestamp":1778258989491,"version":"3.51.4"},"reference-count":39,"publisher":"Springer Science and Business Media LLC","issue":"1","license":[{"start":{"date-parts":[[2023,11,8]],"date-time":"2023-11-08T00:00:00Z","timestamp":1699401600000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"},{"start":{"date-parts":[[2023,11,8]],"date-time":"2023-11-08T00:00:00Z","timestamp":1699401600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"}],"funder":[{"DOI":"10.13039\/501100006041","name":"Innovate UK","doi-asserted-by":"publisher","award":["12328"],"award-info":[{"award-number":["12328"]}],"id":[{"id":"10.13039\/501100006041","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100006041","name":"Innovate UK","doi-asserted-by":"publisher","award":["12328"],"award-info":[{"award-number":["12328"]}],"id":[{"id":"10.13039\/501100006041","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100006041","name":"Innovate UK","doi-asserted-by":"publisher","award":["12328"],"award-info":[{"award-number":["12328"]}],"id":[{"id":"10.13039\/501100006041","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100006041","name":"Innovate UK","doi-asserted-by":"publisher","award":["12328"],"award-info":[{"award-number":["12328"]}],"id":[{"id":"10.13039\/501100006041","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100006041","name":"Innovate UK","doi-asserted-by":"publisher","award":["12328"],"award-info":[{"award-number":["12328"]}],"id":[{"id":"10.13039\/501100006041","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":["J Big Data"],"abstract":"<jats:title>Abstract<\/jats:title><jats:p>Network intrusion detection systems (NIDSs) are one of the main tools used to defend against cyber-attacks. Deep learning has shown remarkable success in network intrusion detection. However, the effect of feature fusion has yet to be explored in how to boost the performance of the deep learning model and improve its generalisation capability in NIDS. In this paper, we propose novel deep learning architectures with different feature fusion mechanisms aimed at improving the performance of the multi-classification components of NIDS. We propose three different deep learning models, which we call early-fusion, late-fusion, and late-ensemble learning models using feature fusion with fully connected deep networks. Our feature fusion mechanisms were designed to encourage deep learning models to learn relationships between different input features more efficiently and mitigate any potential bias that may occur with a particular feature type. To assess the efficacy of our deep learning solutions and make comparisons with state-of-the-art models, we employ the widely accessible UNSW-NB15 and NSL-KDD datasets specifically designed to enhance the development and evaluation of improved NIDSs. Through quantitative analysis, we demonstrate the resilience of our proposed models in effectively addressing the challenges posed by multi-classification tasks, especially in the presence of class imbalance issues. Moreover, our late-fusion and late-ensemble models showed the best generalisation behaviour (against overfitting) with similar performance on the training and validation sets.<\/jats:p>","DOI":"10.1186\/s40537-023-00834-0","type":"journal-article","created":{"date-parts":[[2023,11,8]],"date-time":"2023-11-08T12:02:06Z","timestamp":1699444926000},"update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":59,"title":["Network intrusion detection using feature fusion with deep learning"],"prefix":"10.1186","volume":"10","author":[{"given":"Abiodun","family":"Ayantayo","sequence":"first","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Amrit","family":"Kaur","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Anit","family":"Kour","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Xavier","family":"Schmoor","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Fayyaz","family":"Shah","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Ian","family":"Vickers","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Paul","family":"Kearney","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Mohammed M.","family":"Abdelsamea","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"297","published-online":{"date-parts":[[2023,11,8]]},"reference":[{"key":"834_CR1","unstructured":"Prasad P, Rich C. Market guide for AIOps platforms; 2018. https:\/\/tekwurx.com\/wp-content\/uploads\/2019\/05\/Gartner-Market-Guide-for-AIOps-Platforms-Nov-18.pdf. Retrieved 12 Mar 2020."},{"key":"834_CR2","volume-title":"Learn about intrusion detection and prevention","author":"KM Latha","year":"2016","unstructured":"Latha KM. Learn about intrusion detection and prevention. USA: Juniper Networks; 2016."},{"issue":"7553","key":"834_CR3","doi-asserted-by":"publisher","first-page":"436","DOI":"10.1038\/nature14539","volume":"521","author":"Y LeCun","year":"2015","unstructured":"LeCun Y, Bengio Y, Hinton G. Deep learning. Nature. 2015;521(7553):436\u201344.","journal-title":"Nature"},{"issue":"6","key":"834_CR4","doi-asserted-by":"publisher","first-page":"96","DOI":"10.1109\/MSP.2017.2738401","volume":"34","author":"D Ramachandram","year":"2017","unstructured":"Ramachandram D, Taylor GW. Deep multimodal learning: a survey on recent advances and trends. IEEE Signal Process Mag. 2017;34(6):96\u2013108.","journal-title":"IEEE Signal Process Mag"},{"key":"834_CR5","doi-asserted-by":"crossref","unstructured":"Moustafa N, Slay J. Unsw-NB15: a comprehensive data set for network intrusion detection systems (UNSW-NB15 network data set). In: Military communications and information systems (MilCIS). Canberra: IEEE; 2015. p. 6.","DOI":"10.1109\/MilCIS.2015.7348942"},{"issue":"1\u20133","key":"834_CR6","doi-asserted-by":"publisher","first-page":"18","DOI":"10.1080\/19393555.2015.1125974","volume":"25","author":"N Moustafa","year":"2016","unstructured":"Moustafa N, Slay J. The evaluation of network anomaly detection systems: statistical analysis of the unsw-nb15 data set and the comparison with the kdd99 data set. Inform Sec J Glob Perspect. 2016;25(1\u20133):18\u201331.","journal-title":"Inform Sec J Glob Perspect"},{"key":"834_CR7","doi-asserted-by":"crossref","unstructured":"Tavallaee M, Bagheri E, Lu W, Ghorbani AA. A detailed analysis of the kdd cup 99 data set. In: 2009 IEEE symposium on computational intelligence for security and defense applications. Ottawa: IEEE; 2009. p. 6.","DOI":"10.1109\/CISDA.2009.5356528"},{"key":"834_CR8","doi-asserted-by":"publisher","first-page":"117","DOI":"10.1016\/j.procs.2016.06.016","volume":"89","author":"MC Belavagi","year":"2016","unstructured":"Belavagi MC, Muniyal B. Performance evaluation of supervised machine learning algorithms for intrusion detection. Proc Comp Sci. 2016;89:117\u201323.","journal-title":"Proc Comp Sci"},{"issue":"1","key":"834_CR9","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1186\/s40537-020-00318-5","volume":"7","author":"IH Sarker","year":"2020","unstructured":"Sarker IH, Kayes A, Badsha S, Alqahtani H, Watters P, Ng A. Cybersecurity data science: an overview from machine learning perspective. J Big Data. 2020;7(1):1\u201329.","journal-title":"J Big Data"},{"key":"834_CR10","doi-asserted-by":"crossref","unstructured":"Shaukat K, Luo S, Chen S, Liu D. Cyber threat detection using machine learning techniques: A performance evaluation perspective. In: 2020 International conference on cyber warfare and security (ICCWS). Islamabad: IEEE; 2020. p. 6.","DOI":"10.1109\/ICCWS48432.2020.9292388"},{"key":"834_CR11","doi-asserted-by":"crossref","unstructured":"Soheily-Khah S, Marteau P-F, B\u00e9chet N. Intrusion detection in network systems through hybrid supervised and unsupervised machine learning process: a case study on the ISCX dataset. In: 2018 1st International conference on data intelligence and security (ICDIS). South Padre Island: IEEE; 2018. pp. 19\u2013226.","DOI":"10.1109\/ICDIS.2018.00043"},{"issue":"10","key":"834_CR12","doi-asserted-by":"publisher","first-page":"7162","DOI":"10.1016\/j.eswa.2010.04.017","volume":"37","author":"MS Mok","year":"2010","unstructured":"Mok MS, Sohn SY, Ju YH. Random effects logistic regression model for anomaly detection. Exp Syst Appl. 2010;37(10):7162\u20136.","journal-title":"Exp Syst Appl"},{"issue":"6","key":"834_CR13","first-page":"91","volume":"2","author":"S Bagui","year":"2019","unstructured":"Bagui S, Kalaimannan E, Bagui S, Nandi D, Pinto A. Using machine learning techniques to identify rare cyber-attacks on the UNSW-NB15 dataset. Sec Priv. 2019;2(6):91.","journal-title":"Sec Priv"},{"issue":"5","key":"834_CR14","doi-asserted-by":"publisher","first-page":"439","DOI":"10.1016\/S0167-4048(02)00514-X","volume":"21","author":"Y Liao","year":"2002","unstructured":"Liao Y, Vemuri VR. Use of k-nearest neighbor classifier for intrusion detection. Comp Sec. 2002;21(5):439\u201348.","journal-title":"Comp Sec"},{"key":"834_CR15","doi-asserted-by":"publisher","first-page":"296","DOI":"10.1016\/j.eswa.2016.09.041","volume":"67","author":"WL Al-Yaseen","year":"2017","unstructured":"Al-Yaseen WL, Othman ZA, Nazri MZA. Multi-level hybrid support vector machine and extreme learning machine based on modified k-means for intrusion detection system. Exp Syst Appl. 2017;67:296\u2013303.","journal-title":"Exp Syst Appl"},{"issue":"1","key":"834_CR16","doi-asserted-by":"publisher","first-page":"306","DOI":"10.1016\/j.eswa.2010.06.066","volume":"38","author":"S-J Horng","year":"2011","unstructured":"Horng S-J, Su M-Y, Chen Y-H, Kao T-W, Chen R-J, Lai J-L, Perkasa CD. A novel intrusion detection system based on hierarchical clustering and support vector machines. Exp Syst Appl. 2011;38(1):306\u201313.","journal-title":"Exp Syst Appl"},{"key":"834_CR17","doi-asserted-by":"crossref","unstructured":"Janarthanan T, Zargari S. Feature selection in UNSW-NB15 and KDDCUP\u201999 datasets. In: 2017 IEEE 26th International symposium on industrial electronics (ISIE). Edinburgh: IEEE; 2017. pp. 1881\u20131886.","DOI":"10.1109\/ISIE.2017.8001537"},{"issue":"1","key":"834_CR18","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1186\/s40537-020-00379-6","volume":"7","author":"SM Kasongo","year":"2020","unstructured":"Kasongo SM, Sun Y. Performance analysis of intrusion detection systems using a feature selection method on the UNSW-NB15 dataset. J Big Data. 2020;7(1):1\u201320.","journal-title":"J Big Data"},{"issue":"2","key":"834_CR19","doi-asserted-by":"publisher","first-page":"1397","DOI":"10.1007\/s10586-019-03008-x","volume":"23","author":"V Kumar","year":"2020","unstructured":"Kumar V, Sinha D, Das AK, Pandey SC, Goswami RT. An integrated rule based intrusion detection system: analysis on UNSW-NB15 data set and the real time online dataset. Clust Comp. 2020;23(2):1397\u2013418.","journal-title":"Clust Comp"},{"key":"834_CR20","doi-asserted-by":"crossref","unstructured":"Moustafa N, Slay J. The significant features of the unsw-nb15 and the kdd99 data sets for network intrusion detection systems. In: 2015 4th International workshop on building analysis datasets and gathering experience returns for security (BADGERS). Kyoto: IEEE; 2015. pp. 25\u201331.","DOI":"10.1109\/BADGERS.2015.014"},{"key":"834_CR21","doi-asserted-by":"crossref","unstructured":"Xuren W, Famei H, Rongsheng X. Modeling intrusion detection system by discovering association rule in rough set theory framework. In: 2006 International conference on computational inteligence for modelling control and automation and international conference on intelligent agents web technologies and international commerce (CIMCA\u201906). Sydney: IEEE; 2006. pp. 24\u201324.","DOI":"10.1109\/CIMCA.2006.148"},{"issue":"9","key":"834_CR22","doi-asserted-by":"publisher","first-page":"2373","DOI":"10.1016\/j.patcog.2006.12.009","volume":"40","author":"C-H Tsang","year":"2007","unstructured":"Tsang C-H, Kwong S, Wang H. Genetic-fuzzy rule mining approach and evaluation of feature selection techniques for anomaly intrusion detection. Pattern Recognit. 2007;40(9):2373\u201391.","journal-title":"Pattern Recognit"},{"issue":"2","key":"834_CR23","doi-asserted-by":"publisher","first-page":"1949","DOI":"10.1109\/JIOT.2018.2873125","volume":"6","author":"H Yao","year":"2018","unstructured":"Yao H, Fu D, Zhang P, Li M, Liu Y. Msml: a novel multilevel semi-supervised machine learning framework for intrusion detection system. IEEE Internet Things J. 2018;6(2):1949\u201359.","journal-title":"IEEE Internet Things J"},{"key":"834_CR24","doi-asserted-by":"publisher","DOI":"10.1016\/j.eswa.2022.119030","volume":"213","author":"MHL Louk","year":"2023","unstructured":"Louk MHL, Tama BA. Dual-ids: a bagging-based gradient boosting decision tree model for network anomaly intrusion detection system. Expert Syst Appl. 2023;213: 119030. https:\/\/doi.org\/10.1016\/j.eswa.2022.119030.","journal-title":"Expert Syst Appl"},{"key":"834_CR25","doi-asserted-by":"publisher","DOI":"10.1016\/j.cosrev.2020.100357","volume":"39","author":"BA Tama","year":"2021","unstructured":"Tama BA, Lim S. Ensemble learning for intrusion detection systems: a systematic mapping study and cross-benchmark evaluation. Comp Sci Rev. 2021;39: 100357. https:\/\/doi.org\/10.1016\/j.cosrev.2020.100357.","journal-title":"Comp Sci Rev"},{"key":"834_CR26","doi-asserted-by":"publisher","first-page":"51","DOI":"10.1016\/j.neucom.2019.11.016","volume":"387","author":"C Ieracitano","year":"2020","unstructured":"Ieracitano C, Adeel A, Morabito FC, Hussain A. A novel statistical analysis and autoencoder driven intelligent intrusion detection approach. Neurocomputing. 2020;387:51\u201362.","journal-title":"Neurocomputing"},{"key":"834_CR27","first-page":"125","volume-title":"Cybersecurity and secure information systems. Advanced sciences and technologies for security applications","author":"R Vinayakumar","year":"2019","unstructured":"Vinayakumar R, Soman KP, Poornachandran Prabaharan, Akarsh S. Application of deep learning architectures for cyber security. In: Hassanien A, Elhoseny M, editors. Cybersecurity and secure information systems. Advanced sciences and technologies for security applications. Cham: Springer; 2019. p. 125\u201360."},{"issue":"1","key":"834_CR28","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1186\/s42400-020-00055-5","volume":"3","author":"Y-H Choi","year":"2020","unstructured":"Choi Y-H, Liu P, Shang Z, Wang H, Wang Z, Zhang L, Zhou J, Zou Q. Using deep learning to solve computer security challenges: a survey. Cybersecurity. 2020;3(1):1\u201332.","journal-title":"Cybersecurity"},{"issue":"9","key":"834_CR29","first-page":"2","volume":"3","author":"A Javaid","year":"2016","unstructured":"Javaid A, Niyaz Q, Sun W, Alam M. A deep learning approach for network intrusion detection system. EAI Endorsed Transact Sec Saf. 2016;3(9):2.","journal-title":"EAI Endorsed Transact Sec Saf"},{"key":"834_CR30","doi-asserted-by":"crossref","unstructured":"Alrawashdeh K, Purdy C. Toward an online anomaly intrusion detection system based on deep learning. In: 2016 15th IEEE International conference on machine learning and applications (ICMLA). Anaheim: IEEE; 2016. pp. 195\u2013200.","DOI":"10.1109\/ICMLA.2016.0040"},{"key":"834_CR31","doi-asserted-by":"crossref","unstructured":"Potluri S, Ahmed S, Diedrich C. Convolutional neural networks for multi-class intrusion detection system. In: International conference on mining intelligence and knowledge exploration. Cham: Springer; 2018. pp. 225\u2013238.","DOI":"10.1007\/978-3-030-05918-7_20"},{"issue":"1","key":"834_CR32","doi-asserted-by":"publisher","first-page":"41","DOI":"10.1109\/TETCI.2017.2772792","volume":"2","author":"N Shone","year":"2018","unstructured":"Shone N, Ngoc TN, Phai VD, Shi Q. A deep learning approach to network intrusion detection. IEEE Transact Emerg Top Comput Intell. 2018;2(1):41\u201350.","journal-title":"IEEE Transact Emerg Top Comput Intell"},{"key":"834_CR33","doi-asserted-by":"publisher","first-page":"41525","DOI":"10.1109\/ACCESS.2019.2895334","volume":"7","author":"R Vinayakumar","year":"2019","unstructured":"Vinayakumar R, Alazab M, Soman K, Poornachandran P, Al-Nemrat A, Venkatraman S. Deep learning approach for intelligent intrusion detection system. IEEE Access. 2019;7:41525\u201350.","journal-title":"IEEE Access"},{"key":"834_CR34","doi-asserted-by":"crossref","unstructured":"Altwaijry N, ALQahtani A, AlTuraiki I. A deep learning approach for anomaly-based network intrusion detection. In: Big data and security: first international conference, ICBDS 2019, Nanjing, China, December 20\u201322, 2019, revised selected papers 1. Singapore: Springer; 2020. pp. 603\u2013615 .","DOI":"10.1007\/978-981-15-7530-3_46"},{"issue":"3","key":"834_CR35","doi-asserted-by":"publisher","first-page":"233","DOI":"10.1089\/big.2020.0263","volume":"9","author":"I Al-Turaiki","year":"2021","unstructured":"Al-Turaiki I, Altwaijry N. A convolutional neural network for improved anomaly-based network intrusion detection. Big Data. 2021;9(3):233\u201352.","journal-title":"Big Data"},{"issue":"1","key":"834_CR36","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1186\/s40537-023-00694-8","volume":"10","author":"Y Yin","year":"2023","unstructured":"Yin Y, Jang-Jaccard J, Xu W, Singh A, Zhu J, Sabrina F, Kwak J. IGRF-RFE: a hybrid feature selection method for MLP-based network intrusion detection on UNSW-NB15 dataset. J Big Data. 2023;10(1):1\u201326.","journal-title":"J Big Data"},{"key":"834_CR37","doi-asserted-by":"crossref","unstructured":"Salim S, Lahcen O. Accuracy improvement of network intrusion detection system using bidirectional long-short term memory (bi-lstm). In: Digital technologies and applications: proceedings of ICDTA\u201923, Fez, Morocco. Cham: Springer; 2023. pp. 143\u2013152.","DOI":"10.1007\/978-3-031-29857-8_15"},{"issue":"4","key":"834_CR38","doi-asserted-by":"publisher","first-page":"427","DOI":"10.1016\/j.ipm.2009.03.002","volume":"45","author":"M Sokolova","year":"2009","unstructured":"Sokolova M, Lapalme G. A systematic analysis of performance measures for classification tasks. Inform Proc Manag. 2009;45(4):427\u201337.","journal-title":"Inform Proc Manag"},{"key":"834_CR39","doi-asserted-by":"publisher","first-page":"558","DOI":"10.1016\/j.future.2017.09.056","volume":"79","author":"D Papamartzivanos","year":"2018","unstructured":"Papamartzivanos D, M\u00e1rmol FG, Kambourakis G. Dendron: genetic trees driven rule induction for network intrusion detection systems. Future Gener Comp Syst. 2018;79:558\u201374.","journal-title":"Future Gener Comp Syst"}],"container-title":["Journal of Big Data"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1186\/s40537-023-00834-0.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/article\/10.1186\/s40537-023-00834-0\/fulltext.html","content-type":"text\/html","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1186\/s40537-023-00834-0.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2023,11,8]],"date-time":"2023-11-08T12:06:35Z","timestamp":1699445195000},"score":1,"resource":{"primary":{"URL":"https:\/\/journalofbigdata.springeropen.com\/articles\/10.1186\/s40537-023-00834-0"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2023,11,8]]},"references-count":39,"journal-issue":{"issue":"1","published-online":{"date-parts":[[2023,12]]}},"alternative-id":["834"],"URL":"https:\/\/doi.org\/10.1186\/s40537-023-00834-0","relation":{},"ISSN":["2196-1115"],"issn-type":[{"value":"2196-1115","type":"electronic"}],"subject":[],"published":{"date-parts":[[2023,11,8]]},"assertion":[{"value":"26 November 2022","order":1,"name":"received","label":"Received","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"3 October 2023","order":2,"name":"accepted","label":"Accepted","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"8 November 2023","order":3,"name":"first_online","label":"First Online","group":{"name":"ArticleHistory","label":"Article History"}},{"order":1,"name":"Ethics","group":{"name":"EthicsHeading","label":"Declarations"}},{"value":"The authors declare that they have no competing interests.","order":2,"name":"Ethics","group":{"name":"EthicsHeading","label":"Competing interests"}}],"article-number":"167"}}