More and more network traffic data have brought great challenge to traditional intrusion detection system. The detection performance is tightly related to selected features and classifiers, but traditional feature selection algorithms and classification algorithms can’t perform well in massive data environment. Also the raw traffic data are imbalanced, which has a serious impact on the classification results. In this paper, we propose a novel network intrusion detection model utilizing convolutional neural networks (CNNs). We use CNN to select traffic features from raw data set automatically, and we set the cost function weight coefficient of each class based on its numbers to solve the imbalanced data set problem. The model not only reduces the false alarm rate (FAR) but also improves the accuracy of the class with small numbers. To reduce the calculation cost further, we convert the raw traffic vector format into image format. We use the standard NSL-KDD data set to evaluate the performance of the proposed CNN model. The experimental results show that the accuracy, FAR, and calculation cost of the proposed model perform better than traditional standard algorithms. It is an effective and reliable solution for the intrusion detection of a massive network.

The multi-scale object detection, especially small object detection, is still a challenge task. This paper proposes an improved multi-scale object detection network based on Single Shot MultiBox Detector (SSD), and the network is named as SSD-MSN. SSD-MSN can learn more rich features of small objects from the enlarged areas, which are clipped from raw image. The extra features are contribute to improving detection performance. SSD-MSN includes two subnets: area proposal network (APN) and multi-scale object detection network, namely SSD detector. APN is used to select the area proposals containing one or more objects from clipped areas. SSD detector is used to predict the classification and location of objects from raw image and area proposals. Besides, a valid dividing image strategy is introduced in this paper, which can generate 3*3 clipped areas from raw image. The strategy not only generates more area proposals but also ensures more objects can be contained in each clipped area. It plays as the role of data augmentation, which is critical to detection performance. Experiment results on PASCAL VOC and COCO show that SSD-MSN achieves state-of-the-art detection performance and improves the multi-scale object detection performance effectively.

As the object detection dataset scale is smaller than the image recognition dataset ImageNet scale, transfer learning has become a basic training method for deep learning object detection models, which pre-trains the backbone network of the object detection model on an ImageNet dataset to extract features for detection tasks. However, the classification task of detection focuses on the salient region features of an object, while the location task of detection focuses on the edge features, so there is a certain deviation between the features extracted by a pretrained backbone network and those needed by a localization task. To solve this problem, a decoupled self-attention (DSA) module is proposed for one-stage object-detection models in this paper. A DSA includes two decoupled self-attention branches, so it can extract appropriate features for different tasks. It is located between the Feature Pyramid Networks (FPN) and head networks of subtasks, and used to independently extract global features for different tasks based on FPN-fused features. Although the DSA network module is simple, it can effectively improve the performance of object detection, and can easily be embedded in many detection models. Our experiments are based on the representative one-stage detection model RetinaNet. In the Common Objects in Context (COCO) dataset, when ResNet50 and ResNet101 are used as backbone networks, the detection performances can be increased by 0.4 and 0.5% AP, respectively. When the DSA module and object confidence task are both applied in RetinaNet, the detection performances based on ResNet50 and ResNet101 can be increased by 1.0 and 1.4% AP, respectively. The experiment results show the effectiveness of the DSA module.