|
Evaluating deep learning and traditional machine learning approaches for network intrusion detection |
|---|---|
| รหัสดีโอไอ | |
| Title | Evaluating deep learning and traditional machine learning approaches for network intrusion detection |
| Creator | Gittipot Phuphen |
| Contributor | Wilawan Rukpakavong, Advisor |
| Publisher | Thammasat University |
| Publication Year | 2568 |
| Keyword | Network intrusion detection system, CIC-IDS2017, BCCC-CIC-IDS- 2017, Random forest, Deep learning, Class imbalance, SMOTE, ระบบตรวจจับการบุกรุกเครือข่าย, ชุดข้อมูลล็อกทราฟฟิกเครือข่ายสำหรับวิจัยความปลอดภัย, โมเดลการเรียนรู้ของเครื่องแบบต้นไม้ตัดสินใจรวมกลุ่ม, การเรียนรู้เชิงลึกด้วยโครงข่ายประสาทเทียมหลายชั้น, ปัญหาข้อมูลไม่สมดุลเนื่องจากทราฟฟิกปกติมีมากกว่าทราฟฟิกโจมตีมาก, เทคนิคสร้างข้อมูลจำลองของกลุ่มน้อยเพื่อแก้ปัญหาข้อมูลไม่สมดุล |
| Abstract | While the growth of internet facilitates around the global connectivity, it simultaneously intensifies the scale and sophistication of modern cyber threats. Within this scenery, Network Intrusion Detection Systems (NIDS) become a significant role for delivery continuous networkvisibility and defending core system. The systemic vulnerability of conventional signature based approaches to unknown exploits has shifted attention toward anomaly-based detection capable of extracting behavioral insights via machine learning (ML) and deep learning (DL)models. However, three obstacles hinder current research: highly skewed distributions favoring benign traffic, reliance on outdated datasets, and the intensive processing overhead of heavy neural architectures. This study systematically tackles these challenges by evaluatingtraditional ML, DL, and hybrid DL variants on two structurally unique, flow-based tabular benchmarks: CIC-IDS2017 and BCCC-CIC-IDS-2017. To maintain a rigorous comparative matrix, the design assesses four data-balancing pipelines—P1_None, P2_SMOTE, P3_SMOTE_Tomek, and P4_RUS_50—enforced through a Stratified 5-Fold Cross-Validation envelope that strictly confines preprocessing to the training partition to prevent data leakage. The model architecture matrix includes Random Forest, Decision Tree, SVM, KNN, DNN,CNN, LSTM, CNN-LSTM, and AE-LSTM. Empirical outcomes indicate that for flat, engineered flow features, Random Forest outpaces competing architectures by delivering the highest equilibrium between metric accuracy and training efficiency. Because the heavier deeplearning variants failed to exceed these baseline thresholds despite their extreme computational costs, these findings confirm that model complexity is subject to diminishing returns. Ultimately, for tabular NIDS applications, highly efficient tree-based frameworks represent themore viable operational strategy |
