Anomaly-based intrusion detection on benchmark datasets for network security: a comprehensive evaluation

Abstract

Abstract This study discusses two widely-recognized deep learning approaches for network intrusion detection: a Deep Neural Network (DNN) and a Recurrent Neural Network (RNN). Both models are trained and evaluated on three widely used benchmark datasets: KDDCup99, NSL-KDD (each with five classes), and UNSW-NB15 (ten classes). Multiple optimizers, including Adam, SGD, Adamax, AdamW, and Adadelta, are then explored, with Adam consistently providing the best performance. CrossEntropyLoss is found to be the most effective loss function for these multi-class classification tasks. Designed to automatically learn and extract relevant features from raw data, the models reduce reliance on manual feature engineering. Performance is assessed using accuracy, precision, recall, F1-score, and false positive rate. Experimental results show that both models achieve over 99% accuracy on KDDCup99, with improved detection rates and false positive rates below 1% for KDDCup99 and NSL-KDD. On the more complex UNSW-NB15 dataset, false positive rates also remain under 8%, demonstrating the models’ robustness and generalizability across diverse intrusion scenarios.