SmartVille: A Framework for Realistic Deep Learning-Based Online Network Intrusion Detection

Multi-Class Network Intrusion Detection: Machine and Deep Learning Benchmark with Live Stream Deployment

A hybrid deep reinforcement learning framework for proactive cloud network intrusion detection using spatiotemporal feature learning

Traditional signature-based and static machine-learning-based intrusion detection systems (IDSs) have limited ability to adapt to changing traffic characteristics, and dynamic cloud-based infrastructures are increasingly vulnerable to new and zero-day attacks. Given this drawback, this study aims to develop a hybrid deep reinforcement learning framework for proactive cloud-network intrusion detection, called ShieldDRLNet. It employs a convolutional neural network and a long short-term memory encoder to obtain a spatiotemporal traffic representation and uses a Double Deep Q-Network agent for adaptive sequential decision-making. It features a latency-aware reward function that optimizes the detection correctness, reduces false alarms, penalizes for missed attacks and optimizes the response time. Training stability is achieved by using experience replay and target network updates. Experiments conducted at CICIDS2017 demonstrate that the accuracy, precision, recall, and F1-score of ShieldDRLNet are 97.2%, 95.6%, 96.8%, and 96.2%, respectively, with an average end-to-end detection latency of 4.7 ms per traffic window. It achieves better performance than the classical machine-learning, deep-learning, Transformer and reinforcement-learning baselines, following a shared chronological evaluation protocol. The proposed components also contribute to and generalize the results of ablation, sensitivity and statistical analyses, as well as cross-dataset analyses with UNSW-NB15. The results provide an encouraging deployment-oriented solution to low latency and adaptive intrusion detection in dynamic cloud environments for ShieldDRLNet.

An enhanced multi-model ensemble learning architecture for robust network intrusion detection

Accurately and in real-time identifying advanced cyber-attacks continues to be a serious challenge for modern Network Intrusion Detection Systems (NIDS), especially in situations of highly imbalanced network traffic load and large-scale network attacks. Signature-based and single-model learning methods are typically ineffecive in capturing the complexity of traffic interactions and are not generalizable to new attack patterns. To overcome these limitations, this study introduces an Enhanced Multi-Model Ensemble Network Intrusion Detection System (EME-NIDS), a deep meta-learning system that combines five different heterogeneous learning paradigms, including Convolutional Neural Networks (CNN), Dense Neural Networks, Transformers, XGBoost, and Random Forests. The probabilistic output of the base learners is then condensed into a 220-dimensional meta-feature space and further processed by a five-layer deep meta-learner with approximately 289 k trainable parameters. A large-scale network flow dataset with 703,168 instances was used to assess the learning stability and attack detection of the minority class in the presence of various attacks, with 43 attacks and one attack class (benign) in the dataset. The experimental evaluation provided a detection accuracy of 95.65% and a macro-ROC-AUC score of 99.76%, outperforming all standalone models. Moreover, the proposed framework, which provides an average inference latency of 8.4 ms is suitable for real-time intrusion detection. The robustness, scalability and practical deployment capability of the proposed EME-NIDS framework were confirmed by statistical significance analysis (McNemar’s test, p < 0.001) and ablation studies.

An Anomaly-Based Deep Learning Model for Detecting Known and Zero-Day Attacks in Network Traffic

The rapid growth of digital communication, cloud computing, Internet of Things (IoT), software-defined networking, and edge computing has significantly increased the complexity and volume of network traffic, creating new opportunities for sophisticated cyberattacks. Traditional signature-based intrusion detection systems are highly effective against previously identified threats but often fail to recognize emerging zero-day attacks whose behavioral characteristics have not been previously observed. Consequently, anomaly-based deep learning approaches have gained considerable attention because of their capability to automatically learn complex traffic patterns and identify deviations from legitimate network behavior. This study proposes an anomaly-based deep learning model for detecting both known and zero-day attacks in heterogeneous network environments. The proposed framework integrates advanced traffic preprocessing, automated feature extraction, deep neural representation learning, adaptive anomaly scoring, and intelligent attack classification to enhance detection accuracy while minimizing false alarms. The model is designed to capture nonlinear relationships among network traffic attributes, enabling effective identification of sophisticated intrusion attempts that evade conventional security mechanisms. Furthermore, the proposed architecture emphasizes scalability, robustness, and real-time applicability for modern enterprise networks. The anticipated outcomes demonstrate improved detection performance, reduced false positive rates, enhanced generalization capability for unseen attacks, and strengthened network resilience, thereby providing an effective intelligent cybersecurity solution for next-generation network intrusion detection systems.

AMoE-IDS: An Adaptive Mixture-of-Experts Framework for Cross-Dataset Intrusion Detection

Intrusion Detection Systems (IDS) are essential for securing modern network infrastructures against increasingly sophisticated cyber threats. While deep learning-based IDS have shown promising performance, most existing approaches rely on static and monolithic architectures that struggle to adapt to heterogeneous environments such as Internet of Things (IoT) systems, enterprise networks, and mixed traffic scenarios. Moreover, conventional ensemble and hybrid methods typically employ fixed fusion strategies, limiting their ability to exploit input-dependent specialization. To address these limitations, this paper proposes an Adaptive Mixture-of-Experts Intrusion Detection System (AMoE-IDS), a hybrid deep learning framework that integrates a shared feature encoder, multiple specialized expert networks, and an adaptive gating mechanism. The shared encoder learns a unified latent representation from heterogeneous feature spaces, while the gating network dynamically routes each input to the most relevant experts, enabling conditional computation and improved detection performance. Extensive experiments conducted on three recent benchmark datasets, CICIoT2023, CSE-CICIDS 2018, and TII-SSRC-23, demonstrate that AMoE-IDS consistently outperforms conventional deep learning and hybrid IDS models. The proposed framework achieves F1-scores of 99.19%, 99.67%, and 99.68% and AUC values of 0.992, 0.991, and 0.990 on CICIoT2023, CSE-CICIDS 2018, and TII-SSRC-23, respectively. Despite its multi-expert architecture, the model maintains low inference latency ranging from 1.28 to 1.56 ms per network flow, supporting real-time deployment. Cross-dataset evaluation confirms the robustness of AMoE-IDS under distribution shifts, while ablation studies highlight the critical role of feature harmonization and adaptive expert selection. Statistical significance analysis further validates the reliability of the observed improvements. Overall, the proposed framework demonstrates competitive performance, good scalability, and improved cross-dataset generalization.

From Signature to Attention: Transformer-Powered Intrusion Detection Systems for Cybersecurity

Experimental results demonstrate that the proposed model achieves high detection accuracy, strong discriminative capability, and low false alarm rates across both datasets, confirming its effectiveness and scalability for next-generation cybersecurity applications.