Skip to content
Log in

Similar papers

Open access

Performance evaluation of deep learning models for intrusion detection using network traffic

Digital infrastructures are growing rapidly and cyberattacks are becoming increasingly sophisticated. As a result, Network-based Intrusion Detection Systems have become a critical component of modern cybersecurity. Signature-based methods sometimes fail to detect new threats, where machine learning and deep learning can provide a valuable alternative. This study examines a one-dimensional Convolutional Neural Network and a hybrid model called CNN-BiLSTM, investigating how both architectures can detect network attacks in binary and multiclass classification settings. Both architectures were evaluated on the CIC-IDS2017 and UNSW-NB15 benchmark datasets through a rigorous experimental protocol incorporating stratified 5-fold cross-validation, Focal Loss, QuantileTransformer scaling, and SMOTE oversampling. Random Forest and XGBoost were additionally tested on UNSW-NB15 as classical baselines. The results show that CNN achieves near-perfect binary classification performance on CIC-IDS2017, with 99.75% accuracy and a ROC-AUC of 0.9999. CNN-BiLSTM reduces false negatives by approximately 36% in the binary UNSW-NB15 setting, albeit at the cost of 4–6 times higher inference latency. In multiclass classification, CNN outperforms CNN-BiLSTM on CIC-IDS2017 with a higher macro F1-Score (0.701 vs. 0.671). XGBoost achieves comparable F1 performance to deep learning models in significantly less training time, once again demonstrating the enduring value of ensemble methods. Minority attack class detection remains a fundamental unresolved challenge across all configurations, laying the groundwork for future research on class-wise threshold calibration and Transformer-based architectures. The findings provide actionable insights for practitioners choosing between deep learning and classical approaches under real-world NIDS deployment constraints.

Rachid Cheick Mohamed · 0 citations
Open access Jul 2026

Deep Learning-Based Framework for Zero-Day Attack Detection in Encrypted Network Traffic Using Python

The increasing adoption of encryption in modern communication networks has reduced the effectiveness of traditional intrusion detection systems that rely on packet payload inspection. Consequently, there is a growing demand for payload-agnostic intrusion detection approaches capable of analyzing network behavior without accessing packet contents. This study proposes a deep learning-based intrusion detection framework that utilizes flow-level statistical features and a hybrid Convolutional Neural Network–Bidirectional Long Short-Term Memory (CNN–BiLSTM) architecture to capture both spatial and temporal characteristics of network traffic. The framework was evaluated using the UNSW-NB15 and CIC-IDS2018 benchmark datasets under both in-dataset and cross-dataset evaluation settings. Experimental results demonstrated excellent classification performance in in-dataset experiments, achieving high accuracy and area under the curve (AUC) values. A threshold calibration strategy was further employed to reduce false-positive rates and improve operational reliability. However, cross-dataset evaluation revealed a considerable decline in detection performance, highlighting the impact of domain shift on model generalization across heterogeneous network environments. These findings demonstrate the effectiveness of flow-level statistical features for intrusion detection while emphasizing the importance of developing more robust learning strategies to improve generalization beyond single-dataset training.

H. Hussein, Saad Raad, Ali Qasim · 0 citations
Open access Jul 2026

Interpretable Deep Learning Defences via User Anomaly Detection in Cloud Platforms

Cloud platforms are the targets of highly advanced attacks that are designed to circumvent traditional rule based IDSs, such as: credential misuse, insider threats, privilege escalation, lateral movements, etc. To protect against user attacks, this paper introduces an interpretable deep learning defence framework in the context of user anomaly detection for both IaaS and PaaS cloud service layers and SaaS application layer. Multi-source authentication logs/records, APIs, networks logs are combined into integrated behavioural tensors and classified as anomalies by processing with the recurrent neural network with attention-based temporal weights. The mathematical model for access probability distribution, the model for anomaly scoring and temporal sequence modeling, as well as the model for Mahalanobis-distance-based deviation analysis further enhance the analysis's rigor and interpretability. Experimental results show that the detection accuracy achieved is 97.4%, followed by 96.8% precision, 97.9% recall and 97.3% F1-score, which are much higher than those of the conventional rule-based and black-box deep learning IDSs.

Madhavi Kapre, P. Sahu, Raman Verma et al. · 0 citations
Open access Aug 2026

Feature-guided transformer approach for detecting distributed denial of service attacks

A transformer-based classifier for DDoS detection on the CIC-DDoS2019 dataset demonstrates stable convergence and generalization across folds, highlighting the strength of attention mechanisms in capturing feature dependencies, while also pointing to future directions such as real-time deployment, explainability, and resilience to zero-day attacks.

Lokeshwaran Kanagaraj, Raguraman Purushothaman, Sathya Subramanian et al. · 0 citations
Open access Aug 2026

Deep learning intrusion detection for software-defined networking using synthetic minority oversampling

This article proposes an advanced method for network intrusion detection using a combination of recurrent neural networks (RNNs), specifically long short-term memory (LSTM), gated recurrent units (GRU), and bidirectional long short-term memory (BiLSTM) models, enhanced by synthetic minority oversampling technique (SMOTE) to address class imbalance in datasets like network security laboratory–knowledge discovery in databases (NSL-KDD). The method aims to accurately classify network traffic by learning temporal patterns of both normal and malicious activities. SMOTE is employed to balance the dataset, ensuring that underrepresented attack types receive adequate model attention, thereby improving model robustness. The proposed models (LSTM, GRU, and BiLSTM) are trained and evaluated on the NSL-KDD dataset, with hyperparameter tuning performed through RandomizedSearchCV for optimal performance. The results show a significant improvement in accuracy, precision, recall, and F1-score, with BiLSTM demonstrating the highest performance, achieving near-perfect classification results (99.5% accuracy). This method not only mitigates the issue of class imbalance but also leverages the power of RNNs for sequence modeling, offering a promising solution for effective intrusion detection in modern networks.

Prajwalasimha Sindugatta Nagaraja, Navya Rajashekara, Pushpa Bangalore Ramesh et al. · 0 citations
Open access Jul 2026

A domain-agnostic explainable framework for network attack detection across diverse traffic datasets

An explainable deep learning framework evaluated across multiple heterogeneous cyber attack datasets, including Kitsune, Server-Based network data,enterprise logs, and Malware Traffic datasets, demonstrating the effectiveness of the proposed framework in handling heterogeneous network traffic while providing interpretable insights into model predictions.

Abed Alanazi · 0 citations