Large-Scale Binary Network Intrusion Classification Using a 1D Convolutional Neural Network on CSE-CIC-IDS2018: Performance Evaluation and Methodological Audit

Abstract

Deep learning is increasingly applied to network intrusion detection because it can learn discriminative representations from high-dimensional flow records. This study evaluates a one-dimensional convolutional neural network (1D-CNN) for binary classification of benign and malicious traffic using CSE-CIC-IDS2018 and simultaneously audits the experimental pipeline for threats to independent generalization. The evaluated workflow processed the dataset in chunks, selected traffic features using mutual information, engineered packet-rate and flag-ratio variables, reduced the representation to 20 predictors, balanced the training subset using SMOTE, and trained a regularized Conv1D model with batch normalization, max pooling, dropout, AdamW optimization, and early stopping. The classifier used three convolutional stages with 32, 64, and 128 filters, followed by a regularized 128-unit dense layer and sigmoid output. This architecture was retained consistently throughout the reported benchmark experiment. For the selected 80:20 experiment, the reported confusion matrix contains 1,223,435 true negatives, 45,415 false positives, 29,948 false negatives, and 273,224 true positives. Recalculation gives 95.206% accuracy, 96.421% specificity, 85.747% precision, 90.122% recall, and an F1-score of 87.880%, while the reported ROC-AUC is 97.47%. The methodological audit identifies feature selection and scaling before data partitioning, use of the nominal test partition for validation-based model selection, chunk-wise categorical label coding, and inconsistent post-processing sample counts as important threats to confirmatory interpretation. The findings provide useful benchmark evidence but do not establish leakage-controlled generalization. A stronger replication should split observations before learned preprocessing, map labels deterministically, isolate validation from a locked test set, repeat training across multiple random seeds, and add chronological or cross-dataset evaluation when deployment-level claims are intended.