Open access

A Comparative Evaluation of Deep Learning Architectures for Binary Network Intrusion Detection Using the NSL-KDD Dataset

Ketki Naik Sanjeev Ghosh

Aug 2026 · International Journal for Research in Applied Science and Engineering Technology · 0 citations

TL;DR

Investigation of deep learning models for binary network intrusion detection using the NSL-KDD benchmark dataset indicates that carefully designed standalone architectures can match or exceed the performance of more complex hybrid and ensemble models for binary intrusion detection, while incurring substantially lower computational cost.

Abstract

The rapid growth of digital communication technologies, cloud computing, and Internet of Things (IoT) devices has increased both the frequency and sophistication of cyber-attacks, making effective intrusion detection an essential component of modern cybersecurity systems. Traditional signature-based intrusion detection systems (IDS) are effective against known attacks but fail to detect previously unseen or evolving threats. This study investigates the application of deep learning models for binary network intrusion detection using the NSL-KDD benchmark dataset. Three standalone architectures, Convolutional Neural Networks (CNN), Long Short-Term Memory (LSTM) networks, and Deep Neural Networks (DNN), are implemented and evaluated, alongside a CNN-LSTM Hybrid model that integrates spatial and sequential learning, and a DNN-LSTM Ensemble model that combines independently trained DNN and LSTM predictions through weighted averaging. Following data cleaning, categorical encoding, normalization, and Random Forest-based feature selection (41 features reduced to 20), all models were trained and evaluated under identical conditions using Accuracy, Precision, Recall, F1-Score, ROC-AUC, training time, and inference time. The standalone DNN model achieved the best overall performance, with 80.98% accuracy, 97.08% precision, 68.66% recall, 80.43% F1-score, and 96.11% ROC-AUC, while also requiring the shortest training time (39.69 s). The CNNLSTM Hybrid model attained the highest precision (97.23%) but did not outperform the standalone architectures overall, and the DNN-LSTM Ensemble produced balanced but not superior results. These findings indicate that carefully designed standalone architectures can match or exceed the performance of more complex hybrid and ensemble models for binary intrusion detection, while incurring substantially lower computational cost. The study contributes a controlled, commonframework comparison of five deep learning architectures and provides practical guidance for selecting computationally efficient models for anomaly-based intrusion detection.

DOI Semantic Scholar

Read PDF

Similar papers

Open access Aug 2026

Deep Learning-Based Network Intrusion Detection Using Hybrid CNN and LSTM Architecture

The findings indicate that hybrid deep learning techniques can improve network security by enhancing intrusion detection capability while reducing false alarms.

A. O. Jimoh-Mahmud, Abubakar Dayyabu, Abubakar Sadiq Idris et al. · FUDMA Journal of Sciences · 0 citations

Review 2026

Deep Learning-Driven Intrusion Detection Systems: A Comprehensive Survey of Architectures, Performance Evaluation, and Research Challenges

A taxonomy of IDS architectures and a survey of recently proposed networks, such as Convolutional Neural Networks (CNNs), Recurrent Neural Networks (RNNs), LSTMs, GRUs, Autoencoders, GANs, Transformer-based, as well as hybrids are developed.

Sajith K. V., Gripsy Paul, Bhagavant Deshpande et al. · Journal of Network and Infor... · 0 citations

Open access

Performance evaluation of deep learning models for intrusion detection using network traffic

This study examines a one-dimensional Convolutional Neural Network and a hybrid model, investigating how both architectures can detect network attacks in binary and multiclass classification settings, and provides actionable insights for practitioners choosing between deep learning and classical approaches under real-world NIDS deployment constraints.

Rachid Cheick Mohamed · 0 citations

Open access Aug 2026

Stacked Deep Learning Ensemble Framework for IoT Network Intrusion Detection

Network Intrusion Detection Systems (NIDS) are critical defense layers in modern IoT and IIoT environments, which are disproportionately targeted by evolving cyber threats. Classical machine learning approaches and individual deep learning models face documented limitations, including reliance on outdated datasets, susceptibility to class imbalance, and failure to leverage the complementary detection strengths of diverse architectures. This paper presents the formulation and evaluations of a Stacked Deep Learning Ensemble (SDLE) framework for binary network intrusion detection. The ensemble was based on Recurrent Neural Networks (RNN), Gated Recurrent Units (GRU), and Autoencoders as base learners with a Long Short-Term Memory (LSTM) network as the meta-learner. The framework is trained and evaluated on the ToN_IoT dataset, a contemporary IoT/IIoT benchmark comprising 461,043 records and nine attack categories, following a systematic three-stage preprocessing pipeline that incorporates label encoding, one-hot encoding, feature selection, SMOTE-based class balancing, and standard scaling. Experimental results demonstrate that the SDLE achieves 98.67% accuracy, 98.91% precision, 98.45% recall, and 98.68% F1-score, surpassing each base model and a simple voting ensemble by 0.78–1.94 percentage points. Preprocessing contributes a cumulative gain of 7.43 percentage points over raw data performance, with feature selection identified as the single most impactful step (+2.29%). The results also established that the platform provides an effective IDS model and empirical guidance for preprocessing and meta-learner design in deep learning ensemble systems.

D. Haruna, B. Alese, G. Iwasokun et al. · Advances in Networks · 0 citations

Open access Jul 2026

Optimized Fast-Learning Network Model With SMOTE for University Network Intrusion Detection Systems

An OFLN by addition of PSO to perform automated hyperparameter optimization and MAML to enable high-speed adaptation to new and previously seen attacks is proposed, which is more effective than baseline ensemble models in detection accuracy, resistance to class imbalance and training efficiency.

Robert Wamusi, Guma Ali, Taban Habibu · Baghdad Science Journal · 0 citations

Open access Aug 2026

AI-Driven Security: Detecting Cyber Attacks in IoT Networks

LSTM had good detection for frequent attacks and slow-changing patterns, which shows its capacity in learning long-lasting dependencies, which shows its capacity in learning long-lasting dependencies.

Jawad Hussain Awan, Misbah Safdar, Muhammad Ayaz Shirazi et al. · Italian National Conference... · 0 citations