Abstract
The network intrusion detection system is an important tool for protecting computer networks against threats and malicious attacks. Many techniques have recently been proposed; however, these face significant challenges due to the continuous emergence of new threats that are not recognized by existing systems. In this paper, we propose a novel two-stage deep learning (TSDL) model, based on a stacked auto-encoder with a soft-max classifier, for efficient network intrusion detection. The model comprises two decision stages: an initial stage responsible for classifying network traffic as normal or abnormal, using a probability score value. This is then used in the final decision stage as an additional feature, for detecting the normal state and other classes of attacks. The proposed model is able to learn useful feature representations from large amounts of unlabeled data and classifies them automatically and efficiently. To evaluate its effectiveness, several experiments are conducted on two public datasets, specifically the benchmark KDD99 and UNSW-NB15 datasets. Comparative simulation results demonstrate that our proposed model significantly outperforms existing approaches, achieving high recognition rates, up to 99.996% and 89.134%, for the KDD99 and UNSW-NB15 datasets respectively. We conclude that our model has the potential to serve as a future benchmark for the deep learning and network security research communities.