TL;DR
The proposed explainable framework effectively combines imbalance-aware learning, relation-aware feature modeling, spike-based classification, and causal explainability to deliver accurate, efficient, and interpretable DoS attack detection suitable for real-time cloud security applications.
This study examines a one-dimensional Convolutional Neural Network and a hybrid model, investigating how both architectures can detect network attacks in binary and multiclass classification settings, and provides actionable insights for practitioners choosing between deep learning and classical approaches under real-world NIDS deployment constraints.
A deep learning-based intrusion detection framework that utilizes flow-level statistical features and a hybrid Convolutional Neural Network–Bidirectional Long Short-Term Memory (CNN–BiLSTM) architecture to capture both spatial and temporal characteristics of network traffic is proposed.
This paper introduces an interpretable deep learning defence framework in the context of user anomaly detection for both IaaS and PaaS cloud service layers and SaaS application layer and shows that the detection accuracy and F1-score are much higher than those of the conventional rule-based and black-box deep learning IDSs.
A transformer-based classifier for DDoS detection on the CIC-DDoS2019 dataset demonstrates stable convergence and generalization across folds, highlighting the strength of attention mechanisms in capturing feature dependencies, while also pointing to future directions such as real-time deployment, explainability, and resilience to zero-day attacks.
This article proposes an advanced method for network intrusion detection using a combination of recurrent neural networks (RNNs), specifically long short-term memory (LSTM), gated recurrent units (GRU), and bidirectional long short-term memory (BiLSTM) models, enhanced by synthetic minority oversampling technique (SMOTE) to address class imbalance in datasets like network security laboratory–knowledge discovery in databases (NSL-KDD). The method aims to accurately classify network traffic by learning temporal patterns of both normal and malicious activities. SMOTE is employed to balance the dataset, ensuring that underrepresented attack types receive adequate model attention, thereby improving model robustness. The proposed models (LSTM, GRU, and BiLSTM) are trained and evaluated on the NSL-KDD dataset, with hyperparameter tuning performed through RandomizedSearchCV for optimal performance. The results show a significant improvement in accuracy, precision, recall, and F1-score, with BiLSTM demonstrating the highest performance, achieving near-perfect classification results (99.5% accuracy). This method not only mitigates the issue of class imbalance but also leverages the power of RNNs for sequence modeling, offering a promising solution for effective intrusion detection in modern networks.
An explainable deep learning framework evaluated across multiple heterogeneous cyber attack datasets, including Kitsune, Server-Based network data,enterprise logs, and Malware Traffic datasets, demonstrating the effectiveness of the proposed framework in handling heterogeneous network traffic while providing interpretable insights into model predictions.