{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,10,13]],"date-time":"2026-10-13T07:03:51Z","timestamp":1791875031213,"version":"4.3.4"},"reference-count":53,"publisher":"MDPI AG","issue":"5","license":[{"start":{"date-parts":[[2025,2,24]],"date-time":"2025-02-24T00:00:00Z","timestamp":1740355200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"name":"Jilin Provincial Department of Education","award":["JJKH20240153KJ"],"award-info":[{"award-number":["JJKH20240153KJ"]}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Sensors"],"abstract":"<jats:p>Network intrusion detection systems can identify intrusion behavior in a network by analyzing network traffic data. It is challenging to detect a very small proportion of intrusion data from massive network traffic and identify the attack class in intrusion detection tasks. Many existing intrusion detection studies often fail to fully extract the spatial features of network traffic and make reasonable use of temporal features. In this paper, we propose ADFCNN-BiLSTM, a novel deep neural network for network intrusion detection. ADFCNN-BiLSTM uses deformable convolution and an attention mechanism to adaptively extract the spatial features of network traffic data, and it pays attention to the important features from both channel and spatial perspectives. It uses BiLSTM to mine the temporal features from the traffic data and employs the multi-head attention mechanism to allow the network to focus on the time-series information related to suspicious traffic. In addition, ADFCNN-BiLSTM addresses the issue of class imbalance during the training process at both the data level and algorithm level. We evaluated the proposed ADFCNN-BiLSTM on three standard datasets, i.e., NSL-KDD, UNSW-NB15, and CICDDoS2019. The experimental results show that ADFCNN-BiLSTM outperforms the state-of-the-art model in terms of accuracy, detection rate, and false-positive rate.<\/jats:p>","DOI":"10.3390\/s25051382","type":"journal-article","created":{"date-parts":[[2025,2,24]],"date-time":"2025-02-24T07:46:57Z","timestamp":1740383217000},"page":"1382","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":21,"title":["ADFCNN-BiLSTM: A Deep Neural Network Based on Attention and Deformable Convolution for Network Intrusion Detection"],"prefix":"10.3390","volume":"25","author":[{"ORCID":"https:\/\/orcid.org\/0000-0001-8268-0430","authenticated-orcid":false,"given":"Bin","family":"Li","sequence":"first","affiliation":[{"name":"School of Computer Science, Northeast Electric Power University, Jilin 132012, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Jie","family":"Li","sequence":"additional","affiliation":[{"name":"School of Computer Science, Northeast Electric Power University, Jilin 132012, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Mingyu","family":"Jia","sequence":"additional","affiliation":[{"name":"School of Computer Science, Northeast Electric Power University, Jilin 132012, China"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"1968","published-online":{"date-parts":[[2025,2,24]]},"reference":[{"key":"ref_1","doi-asserted-by":"crossref","unstructured":"Gao, M., Ma, L., Liu, H., Zhang, Z., Ning, Z., and Xu, J. (2020). Malicious network traffic detection based on deep neural networks and association analysis. Sensors, 20.","DOI":"10.3390\/s20051452"},{"key":"ref_2","doi-asserted-by":"crossref","unstructured":"Elhanashi, A., Dini, P., Saponara, S., and Zheng, Q. (2023). Integration of Deep Learning into the IoT: A Survey of Techniques and Challenges for Real-World Applications. Electronics, 12.","DOI":"10.3390\/electronics12244925"},{"key":"ref_3","doi-asserted-by":"crossref","first-page":"103792","DOI":"10.1016\/j.cose.2024.103792","article-title":"A comprehensive survey on cyber deception techniques to improve honeypot performance","volume":"140","author":"Javadpour","year":"2024","journal-title":"Comput. Secur."},{"key":"ref_4","doi-asserted-by":"crossref","first-page":"e4150","DOI":"10.1002\/ett.4150","article-title":"Network intrusion detection system: A systematic study of machine learning and deep learning approaches","volume":"32","author":"Ahmad","year":"2021","journal-title":"Trans. Emerg. Telecommun. Technol."},{"key":"ref_5","doi-asserted-by":"crossref","first-page":"1331","DOI":"10.1007\/s10207-023-00794-9","article-title":"A perspective\u2013retrospective analysis of diversity in signature-based open-source network intrusion detection systems","volume":"23","author":"Asad","year":"2024","journal-title":"Int. J. Inf. Secur."},{"key":"ref_6","doi-asserted-by":"crossref","first-page":"102675","DOI":"10.1016\/j.cose.2022.102675","article-title":"A systematic literature review of methods and datasets for anomaly-based network intrusion detection","volume":"116","author":"Yang","year":"2022","journal-title":"Comput. Secur."},{"key":"ref_7","doi-asserted-by":"crossref","unstructured":"Padmaja, R., and Challagundla, P.R. (2024, January 24\u201325). Exploring a two-phase deep learning framework for network intrusion detection. Proceedings of the 2024 IEEE International Students\u2019 Conference on Electrical, Electronics and Computer Science (SCEECS), Bhopal, India.","DOI":"10.1109\/SCEECS61402.2024.10482198"},{"key":"ref_8","doi-asserted-by":"crossref","first-page":"1397","DOI":"10.1109\/IC2PCT60090.2024.10486517","article-title":"An AI-driven based cybersecurity system for network intrusion detection system in hybrid with EPO and CNNet-LAM","volume":"Volume 5","author":"Disney","year":"2024","journal-title":"Proceedings of the 2024 IEEE International Conference on Computing, Power and Communication Technologies (IC2PCT)"},{"key":"ref_9","doi-asserted-by":"crossref","first-page":"103656","DOI":"10.1016\/j.cose.2023.103656","article-title":"Hybrid rat swarm hunter prey optimization trained deep learning for network intrusion detection using CNN features","volume":"139","author":"Parameswari","year":"2024","journal-title":"Comput. Secur."},{"key":"ref_10","doi-asserted-by":"crossref","first-page":"04012","DOI":"10.1051\/e3sconf\/202449104012","article-title":"Intrusion detection system using machine learning by RNN method","volume":"Volume 491","author":"Azarudeen","year":"2024","journal-title":"Proceedings of the E3S Web of Conferences"},{"key":"ref_11","first-page":"2315","article-title":"Fusion of spiral convolution-LSTM for intrusion detection modeling","volume":"79","author":"Wang","year":"2024","journal-title":"Comput. Mater. Contin."},{"key":"ref_12","doi-asserted-by":"crossref","first-page":"415","DOI":"10.1016\/j.aej.2023.11.078","article-title":"Golden jackal optimization algorithm with deep learning assisted intrusion detection system for network security","volume":"86","author":"Aljehane","year":"2024","journal-title":"Alex. Eng. J."},{"key":"ref_13","doi-asserted-by":"crossref","unstructured":"Sinha, J., and Manollas, M. (2020, January 26\u201328). Efficient deep CNN-BiLSTM model for network intrusion detection. Proceedings of the 2020 3rd International Conference on Artificial Intelligence and Pattern Recognition (AIPR \u201920), Xiamen, China.","DOI":"10.1145\/3430199.3430224"},{"key":"ref_14","first-page":"17","article-title":"Survey of deep learning-based network intrusion detection","volume":"18","author":"Zhang","year":"2019","journal-title":"J. Guangzhou Univ. (Nat. Sci. Ed.)"},{"key":"ref_15","first-page":"1","article-title":"Comparative analysis of resampling techniques under noisy imbalanced datasets","volume":"Volume 1","author":"Puri","year":"2019","journal-title":"Proceedings of the 2019 International Conference on Issues and Challenges in Intelligent Computing Techniques (ICICT)"},{"key":"ref_16","doi-asserted-by":"crossref","first-page":"333","DOI":"10.1016\/j.neucom.2020.08.060","article-title":"EHSO: Evolutionary hybrid sampling in overlapping scenarios for imbalanced learning","volume":"417","author":"Zhu","year":"2020","journal-title":"Neurocomputing"},{"key":"ref_17","doi-asserted-by":"crossref","first-page":"200","DOI":"10.1016\/j.neucom.2020.05.030","article-title":"Local distribution-based adaptive minority oversampling for imbalanced data classification","volume":"422","author":"Xw","year":"2021","journal-title":"Neurocomputing"},{"key":"ref_18","doi-asserted-by":"crossref","first-page":"240","DOI":"10.1016\/j.future.2022.01.026","article-title":"Imbalanced data classification: A KNN and generative adversarial networks-based hybrid approach for intrusion detection","volume":"131","author":"Ding","year":"2022","journal-title":"Future Gener. Comput. Syst."},{"key":"ref_19","doi-asserted-by":"crossref","first-page":"110724","DOI":"10.1016\/j.comnet.2024.110724","article-title":"An intrusion detection method combining variational auto-encoder and generative adversarial networks","volume":"253","author":"Li","year":"2024","journal-title":"Comput. Netw."},{"key":"ref_20","doi-asserted-by":"crossref","first-page":"321","DOI":"10.1613\/jair.953","article-title":"SMOTE: Synthetic minority over-sampling technique","volume":"16","author":"Chawla","year":"2002","journal-title":"J. Artif. Intell. Res."},{"key":"ref_21","doi-asserted-by":"crossref","unstructured":"Xu, Z., Shen, D., Nie, T., and Kou, Y. (2020). A hybrid sampling algorithm combining m-SMOTE and ENN based on random forest for medical imbalanced data. J. Biomed. Inform., 107.","DOI":"10.1016\/j.jbi.2020.103465"},{"key":"ref_22","doi-asserted-by":"crossref","first-page":"190","DOI":"10.1016\/j.dcan.2023.03.008","article-title":"IDS-INT: Intrusion detection system using transformer-based transfer learning for imbalanced network traffic","volume":"10","author":"Ullah","year":"2024","journal-title":"Digit. Commun. Netw."},{"key":"ref_23","doi-asserted-by":"crossref","first-page":"5809","DOI":"10.1109\/TNSM.2024.3414305","article-title":"ENIDS: A deep learning-based ensemble framework for network intrusion detection systems","volume":"21","author":"Sayem","year":"2024","journal-title":"IEEE Trans. Netw. Serv. Manag."},{"key":"ref_24","doi-asserted-by":"crossref","first-page":"111517","DOI":"10.1016\/j.asoc.2024.111517","article-title":"Towards unbalanced multiclass intrusion detection with hybrid sampling methods and ensemble classification","volume":"157","author":"Shin","year":"2024","journal-title":"Appl. Soft Comput."},{"key":"ref_25","doi-asserted-by":"crossref","first-page":"113864","DOI":"10.1016\/j.eswa.2020.113864","article-title":"M-AdaBoost-A based ensemble system for network intrusion detection","volume":"162","author":"Zhou","year":"2020","journal-title":"Expert Syst. Appl."},{"key":"ref_26","first-page":"1995","article-title":"Strengthening network security: Deep learning models for intrusion detection with optimized feature subset and effective imbalance handling","volume":"78","author":"Xu","year":"2024","journal-title":"Comput. Mater. Contin."},{"key":"ref_27","doi-asserted-by":"crossref","first-page":"53099","DOI":"10.1109\/ACCESS.2024.3384528","article-title":"Network intrusion detection method based on CNN, BiLSTM, and attention mechanism","volume":"12","author":"Dai","year":"2024","journal-title":"IEEE Access"},{"key":"ref_28","doi-asserted-by":"crossref","unstructured":"Nguyet, L., and Hai, T.H. (2023, January 22\u201324). Evaluation of deep CNN-BiLSTM model on diverse datasets. Proceedings of the 2023 International Conference on Advanced Computing and Analytics (ACOMPA), Da Nang City, Vietnam.","DOI":"10.1109\/ACOMPA61072.2023.00012"},{"key":"ref_29","first-page":"7272479","article-title":"Network intrusion detection method combining CNN and BiLSTM in cloud computing environment","volume":"2022","author":"Gao","year":"2022","journal-title":"Comput. Intell. Neurosci."},{"key":"ref_30","doi-asserted-by":"crossref","unstructured":"Zhang, Y., Guo, Z., Ma, H., Guan, Q., Jiang, W., and Li, W. (2024). An efficient CNN+ Sparse Transformer-based intrusion detection method for IoT. Advanced Intelligent Computing Technology and Applications, Springer.","DOI":"10.1007\/978-981-97-5609-4_38"},{"key":"ref_31","doi-asserted-by":"crossref","unstructured":"Jouhari, M., and Guizani, M. (2024). Lightweight CNN-BiLSTM based intrusion detection systems for resource-constrained IoT devices. arXiv.","DOI":"10.1109\/IWCMC61514.2024.10592352"},{"key":"ref_32","doi-asserted-by":"crossref","first-page":"138732","DOI":"10.1109\/ACCESS.2023.3340142","article-title":"CNN-BiLSTM: A hybrid deep learning approach for network intrusion detection system in software-defined networking with hybrid feature selection","volume":"11","author":"Said","year":"2023","journal-title":"IEEE Access"},{"key":"ref_33","doi-asserted-by":"crossref","unstructured":"Wang, Q., Wu, B., Zhu, P., Li, P., Zuo, W., and Hu, Q. (2020, January 13\u201319). ECA-Net: Efficient channel attention for deep convolutional neural networks. Proceedings of the IEEE\/CVF Conference on Computer Vision and Pattern Recognition, Seattle, WA, USA.","DOI":"10.1109\/CVPR42600.2020.01155"},{"key":"ref_34","doi-asserted-by":"crossref","unstructured":"Woo, S., Park, J., Lee, J.Y., and Kweon, I.S. (2018, January 8\u201314). Cbam: Convolutional block attention module. Proceedings of the European Conference on Computer Vision (ECCV), Munich, Germany.","DOI":"10.1007\/978-3-030-01234-2_1"},{"key":"ref_35","doi-asserted-by":"crossref","unstructured":"Tan, J., Lu, X., Zhang, G., Yin, C., and Li, Q. (2021, January 20\u201325). Equalization loss v2: A new gradient balance approach for long-tailed object detection. Proceedings of the IEEE\/CVF Conference on Computer Vision and Pattern Recognition (CVPR), Nashville, TN, USA.","DOI":"10.1109\/CVPR46437.2021.00173"},{"key":"ref_36","doi-asserted-by":"crossref","unstructured":"Meena, G., and Choudhary, R.R. (2017, January 1\u20132). A review paper on IDS classification using KDD 99 and NSL KDD dataset in WEKA. Proceedings of the 2017 International Conference on Computer, Communications and Electronics (Comptelix), Jaipur, India.","DOI":"10.1109\/COMPTELIX.2017.8004032"},{"key":"ref_37","doi-asserted-by":"crossref","unstructured":"Moustafa, N., and Slay, J. (2015, January 10\u201312). UNSW-NB15: A comprehensive data set for network intrusion detection systems (UNSW-NB15 network data set). Proceedings of the 2015 Military Communications and Information Systems Conference (MilCIS), Canberra, ACT, Australia.","DOI":"10.1109\/MilCIS.2015.7348942"},{"key":"ref_38","doi-asserted-by":"crossref","unstructured":"Sharafaldin, I., Lashkari, A.H., Hakak, S., and Ghorbani, A.A. (2019, January 1\u20133). Developing realistic distributed denial of service (DDoS) attack dataset and taxonomy. Proceedings of the 2019 International Carnahan Conference on Security Technology (ICCST), Chennai, India.","DOI":"10.1109\/CCST.2019.8888419"},{"key":"ref_39","doi-asserted-by":"crossref","first-page":"170","DOI":"10.1016\/j.comcom.2023.04.018","article-title":"CANET: A hierarchical cnn-attention model for network intrusion detection","volume":"205","author":"Ren","year":"2023","journal-title":"Comput. Commun."},{"key":"ref_40","doi-asserted-by":"crossref","first-page":"120420","DOI":"10.1016\/j.eswa.2023.120420","article-title":"DUEN: Dynamic ensemble handling class imbalance in network intrusion detection","volume":"229","author":"Ren","year":"2023","journal-title":"Expert Syst. Appl."},{"key":"ref_41","doi-asserted-by":"crossref","first-page":"578","DOI":"10.1016\/j.procs.2024.03.042","article-title":"Machine learning-based intrusion detection on multi-class imbalanced dataset using SMOTE","volume":"234","author":"Widodo","year":"2024","journal-title":"Procedia Comput. Sci."},{"key":"ref_42","doi-asserted-by":"crossref","unstructured":"Yu, X., Lu, Y., Jiang, F., Hu, Q., Du, J., and Gong, D. (2024). A cross-domain intrusion detection method based on nonlinear augmented explicit features. IEEE Trans. Netw. Serv. Manag.","DOI":"10.1109\/TNSM.2024.3444909"},{"key":"ref_43","doi-asserted-by":"crossref","first-page":"7147","DOI":"10.1109\/TIFS.2024.3431932","article-title":"K-GetNID: Knowledge-guided graphs for early and transferable network intrusion detection","volume":"19","author":"Wang","year":"2024","journal-title":"IEEE Trans. Inf. Forensics Secur."},{"key":"ref_44","doi-asserted-by":"crossref","first-page":"108162","DOI":"10.1016\/j.engappai.2024.108162","article-title":"A fast intrusion detection system based on swift wrapper feature selection and speedy ensemble classifier","volume":"133","author":"Zorarpaci","year":"2024","journal-title":"Eng. Appl. Artif. Intell."},{"key":"ref_45","doi-asserted-by":"crossref","first-page":"107247","DOI":"10.1016\/j.comnet.2020.107247","article-title":"Building an efficient intrusion detection system based on feature selection and ensemble classifier","volume":"174","author":"Zhou","year":"2020","journal-title":"Comput. Network."},{"key":"ref_46","doi-asserted-by":"crossref","first-page":"102289","DOI":"10.1016\/j.cose.2021.102289","article-title":"A fast network intrusion detection system using adaptive synthetic oversampling and LightGBM","volume":"106","author":"Liu","year":"2021","journal-title":"Comput. Secur."},{"key":"ref_47","doi-asserted-by":"crossref","first-page":"3","DOI":"10.1007\/s40860-020-00126-x","article-title":"A smart anomaly-based intrusion detection system for the Internet of Things (IoT) network using GWO\u2013PSO\u2013RF model","volume":"7","author":"Keserwani","year":"2021","journal-title":"J. Reliab. Intell. Environ."},{"key":"ref_48","doi-asserted-by":"crossref","first-page":"113249","DOI":"10.1016\/j.eswa.2020.113249","article-title":"A feature selection algorithm for intrusion detection system based on pigeon inspired optimizer","volume":"148","author":"Alazzam","year":"2020","journal-title":"Expert Syst. Appl."},{"key":"ref_49","doi-asserted-by":"crossref","first-page":"1156","DOI":"10.1109\/TIFS.2023.3331240","article-title":"TMG-GAN: Generative adversarial networks-based imbalanced learning for network intrusion detection","volume":"19","author":"Ding","year":"2023","journal-title":"IEEE Trans. Inf. Forensics Secur."},{"key":"ref_50","doi-asserted-by":"crossref","first-page":"7130868","DOI":"10.1155\/2019\/7130868","article-title":"Building an effective intrusion detection system by using hybrid data optimization based on machine learning algorithms","volume":"2019","author":"Ren","year":"2019","journal-title":"Secur. Commun. Netw."},{"key":"ref_51","doi-asserted-by":"crossref","first-page":"8946","DOI":"10.1007\/s11227-021-04241-1","article-title":"KS-DDoS: Kafka streams-based classification approach for DDoS attacks","volume":"78","author":"Patil","year":"2022","journal-title":"J. Supercomput."},{"key":"ref_52","doi-asserted-by":"crossref","first-page":"103408","DOI":"10.1016\/j.advengsoft.2022.103408","article-title":"Hybrid classification model with tuned weight for cyber-attack detection: Big data perspective","volume":"177","author":"Packialatha","year":"2023","journal-title":"Adv. Eng. Softw."},{"key":"ref_53","doi-asserted-by":"crossref","first-page":"1355","DOI":"10.1007\/s10586-022-03538-x","article-title":"SSK-DDoS: Distributed stream processing framework based classification system for DDoS attacks","volume":"25","author":"Patil","year":"2022","journal-title":"Clust. Comput."}],"container-title":["Sensors"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/1424-8220\/25\/5\/1382\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,9]],"date-time":"2025-10-09T16:41:29Z","timestamp":1760028089000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/1424-8220\/25\/5\/1382"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,2,24]]},"references-count":53,"journal-issue":{"issue":"5","published-online":{"date-parts":[[2025,3]]}},"alternative-id":["s25051382"],"URL":"https:\/\/doi.org\/10.3390\/s25051382","relation":{},"ISSN":["1424-8220"],"issn-type":[{"value":"1424-8220","type":"electronic"}],"subject":[],"published":{"date-parts":[[2025,2,24]]}}}