Comparison of Network Attack Detection Algorithms Based on NSL-KDD Dataset
TL;DR
The paper put three classical machine learning methods—Decision Tree, Random Forest, and K-Nearest Neighbors—through the same set of binary and five-class detection tests, arguing for treating rare-class detection as the main priority in future work.
Abstract
Intrusion detection systems built on hand-written rules are losing ground as attackers find new ways to bypass fixed signatures. Working with the NSL-KDD benchmark, the paper put three classical machine learning methods—Decision Tree (DT), Random Forest (RF), and K-Nearest Neighbors (KNN)—through the same set of binary and five-class detection tests. Random forest handled the diverse five-class label set best, hitting 76.3% accuracy with an F1 of 0.720. In the simpler binary task, however, the decision tree pulled ahead (81.2%, F1 0.813). The reason was straightforward: the ensemble model grew too cautious when samples were scarce, suppressing false alarms at the cost of missing real attacks. DoS floods were caught almost without fail (F1 0.884). R2L and U2R, on the other hand, evaded detection almost entirely—their training presence was vanishingly small, at 0.83% and 0.04% of the training pool. Feature importance scores from the random forest pointed overwhelmingly to traffic volume and rate-based statistics as the strongest signals, while class skew stood out as the single largest obstacle. Rather than chasing marginal accuracy gains, the results argue for treating rare-class detection as the main priority in future work.