A Lightweight NLP-CNN Framework Based on Semantic Flow Representation for Network Intrusion Detection

Abstract

Attacks against networks keep changing form, and Intrusion Detection Systems (IDS) still stand among the first defenses expected to catch them. Deep learning brought real gains in detection accuracy, but a habit persists across most published models: traffic enters as flat tabular records, and whatever context ties one attribute to another is thrown away before training begins. This work follows a different route. Every network record is rewritten as a short piece of text - the protocol, the connection state, the ports, and a few traffic statistics, joined into what we call a semantic flow - after which the sequence is tokenized, embedded, and handed to a small Convolutional Neural Network (CNN). No transformer appears anywhere in the pipeline, and no recurrent stack either; the representation itself does the heavy lifting. Four benchmark datasets served for the evaluation (CIC-IDS-2017, KDDCup99, NSL-KDD, and Hogzilla), in binary as well as multiclass settings. Accuracy fell between 99.04% and 99.95%, F1-scores held above 0.99, and AUC values remained high - figures we read with prudence, since they come from benchmark data alone. Even so, one lesson emerges from the experiments: putting the effort into how traffic is written down, instead of making the classifier heavier, offers an economical and workable path to intrusion detection across heterogeneous network environments.