Performance evaluation of deep learning models for intrusion detection using network traffic

A Comparative Evaluation of Deep Learning Architectures for Binary Network Intrusion Detection Using the NSL-KDD Dataset

The rapid growth of digital communication technologies, cloud computing, and Internet of Things (IoT) devices has increased both the frequency and sophistication of cyber-attacks, making effective intrusion detection an essential component of modern cybersecurity systems. Traditional signature-based intrusion detection systems (IDS) are effective against known attacks but fail to detect previously unseen or evolving threats. This study investigates the application of deep learning models for binary network intrusion detection using the NSL-KDD benchmark dataset. Three standalone architectures, Convolutional Neural Networks (CNN), Long Short-Term Memory (LSTM) networks, and Deep Neural Networks (DNN), are implemented and evaluated, alongside a CNN-LSTM Hybrid model that integrates spatial and sequential learning, and a DNN-LSTM Ensemble model that combines independently trained DNN and LSTM predictions through weighted averaging. Following data cleaning, categorical encoding, normalization, and Random Forest-based feature selection (41 features reduced to 20), all models were trained and evaluated under identical conditions using Accuracy, Precision, Recall, F1-Score, ROC-AUC, training time, and inference time. The standalone DNN model achieved the best overall performance, with 80.98% accuracy, 97.08% precision, 68.66% recall, 80.43% F1-score, and 96.11% ROC-AUC, while also requiring the shortest training time (39.69 s). The CNNLSTM Hybrid model attained the highest precision (97.23%) but did not outperform the standalone architectures overall, and the DNN-LSTM Ensemble produced balanced but not superior results. These findings indicate that carefully designed standalone architectures can match or exceed the performance of more complex hybrid and ensemble models for binary intrusion detection, while incurring substantially lower computational cost. The study contributes a controlled, commonframework comparison of five deep learning architectures and provides practical guidance for selecting computationally efficient models for anomaly-based intrusion detection.

Deep Learning-Based Network Intrusion Detection Using Hybrid CNN and LSTM Architecture

The findings indicate that hybrid deep learning techniques can improve network security by enhancing intrusion detection capability while reducing false alarms.

Optimized Fast-Learning Network Model With SMOTE for University Network Intrusion Detection Systems

Traditional Intrusion Detection Systems (IDSs) tend to have a high false positive detection rate, are time-consuming to train, and lack the flexibility to react quickly to changing cyber threats, such as Distributed Denial of Service (DDoS) attacks and phishing. Such restrictions decrease the responsiveness and reliability of the IDS services implemented in the university network, both wired and wireless, at the Uganda Christian University (UCU), where network and traffic analysis have become a necessity. This study analyzes the current threat environment of networking at UCU in terms of the type, origin, and target of various attacks to identify gaps in existing detection tools. To address data imbalance and high dimensionality, a range of machine learning algorithms was implemented and paired: Random Forest (RF), XGBoost, AdaBoost, Decision Trees, Convolutional Neural Networks (CNNs), and SMOTE. The highest performance was obtained by the combination of RF and SMOTE, with an accuracy of 81.88%, a precision of 82.17%, a recall of 81.88% and an F1-score of 80.19%. These ensemble learning methods can be effectively combined with oversampling to better detect minority attacks and minimize false alarms. This paper proposes an OFLN by addition of PSO to perform automated hyperparameter optimization and MAML to enable high-speed adaptation to new and previously seen attacks. The OFLN incorporates swarm-based optimization with meta-learning, attaining faster convergence, better generalization and efficiency. Empirical results show that OFLN is more effective than baseline ensemble models in detection accuracy, resistance to class imbalance and training efficiency, making it an innovative, scalable and practical IDS.

Deep Learning-Based Framework for Zero-Day Attack Detection in Encrypted Network Traffic Using Python

A deep learning-based intrusion detection framework that utilizes flow-level statistical features and a hybrid Convolutional Neural Network–Bidirectional Long Short-Term Memory (CNN–BiLSTM) architecture to capture both spatial and temporal characteristics of network traffic is proposed.

AI-Driven Security: Detecting Cyber Attacks in IoT Networks

Traditional rule-based intrusion detection systems generally fail in identifying unknown or evolving threats; thus, automated and adaptive kinds of methods are crucial. Deep learning models provide promising solutions, but many recent studies depend on hybrid architecture, which increase the computational cost and reduce deploying ability on real-time or resource-limited systems. In this paper, we present and test a standalone LSTM model for multiclass cyberattack detection based on a CIC_IoT_Dataset2023, a recent labeled dataset that mirrors the actual network environment containing 33 attack categories. The dataset was extremely imbalanced as benign traffic accounted for most of the classes. To detect such attacks, we used the Synthetic Minority Oversampling Technique (SMOTE) to increase the frequency of less common types of address. The pre-processed dataset was then employed to train four models (RNN, CNN, DNN and the proposed LSTM) for performance analysis with sequential data. The proposed LSTM model achieved an accuracy between 2% and 7%. LSTM had good detection for frequent attacks and slow-changing patterns, which shows its capacity in learning long-lasting dependencies. The results demonstrate that a simple, lightweight standalone LSTM model can be used for effective and realistic intrusion detection without the need for complex hybrid architecture.

Multi-Class Network Intrusion Detection: Machine and Deep Learning Benchmark with Live Stream Deployment