Deep Learning vs. Machine Learning for Intrusion Detection in Computer Networks: A Comparative Study
Source abstract
Abstract
In response to the increasing volume of network traffic and the growing sophistication of cyber threats, this study examines the use of deep learning-based intrusion detection systems (IDSs) in large-scale network environments. Traditional IDS face challenges such as high false positive rates, complex feature engineering, and class imbalances in datasets, all of which impede accurate threat detection. To overcome these limitations, we implement various deep learning models, including multilayer perceptron (MLP), convolutional neural network (CNN), and long short-term memory (LSTM), alongside traditional machine learning algorithms such as logistic regression, naive Bayes, random forest, K-nearest neighbors, and decision trees. A significant contribution of this study is the application of the synthetic minority over-sampling technique (SMOTE) to address class imbalance, enhancing the representativeness of the learning process. Additionally, we conduct a comprehensive performance comparison of the models, incorporating correlation-based feature selection and hyperparameter tuning to maximize detection accuracy. Our results indicate that deep learning models, particularly CNN and LSTM, outperform traditional machine learning approaches in cyber threat detection, achieving accuracy rates of 98%. However, random forest achieves the highest accuracy at 99.9%, demonstrating its effectiveness in structured intrusion detection tasks. Moreover, we evaluate computational efficiency and practical deployment considerations, discussing trade-offs between accuracy and resource consumption. These findings highlight the potential of deep learning-based IDS for large-scale network security applications while addressing key challenges such as interpretability and computational overhead. The study provides actionable insights for selecting the most suitable IDS models based on specific network environments and security requirements.
Source: crossref · Quality: baseline
Research context
OpenAlex topics: Network Security and Intrusion Detection · Advanced Malware Detection Techniques
SciVX discovery tags are terminology-based. OpenAlex topics are source-provided classifications.
Affiliations
Department of Computer Science & Physics, Rider University, Lawrenceville, NJ 08648, USA
College of Professional Studies, St. John’s University, New York, NY 11439, USA
References (62)
Show source-provided references
1. Enhancing network intrusion detection systems with combined network and host traffic features using deep learning: Deep learning and IoT perspective10.1007/s10791-024-09480-3 ↗
2. Vullam, N., Roja, D., Rao, N., Vellela, S.S., Vuyyuru, L.R., and Kumar, K.K. (2023, January 28–29). Enhancing Intrusion Detection Systems for Secure E-Commerce Communication Networks. Proceedings of the 2023 International Conference on the Confluence of Advancements in Robotics, Vision and Interdisciplinary Technology Management (IC-RVITM), Bengaluru, India.10.1109/IC-RVITM60032.2023.10435178 ↗
3. Social media update 2016
4. Ali, M.L., Thakur, K., and Atobatele, B. (2019, January 27–30). Challenges of cyber security and the emerging trends. Proceedings of the 2019 ACM International Symposium on Blockchain and Secure Critical Infrastructure, Seoul, Republic of Korea.10.1145/3327960.3332393 ↗
5. Digital transformation10.1109/MS.2018.2801537 ↗
6. Enterprise data breach: Causes, challenges, prevention, and future directions10.1002/widm.1211 ↗
7. Cyber-attacks–trends, patterns and security countermeasures10.1016/S2212-5671(15)01077-1 ↗
8. COVID-19 age: Challenges in cybersecurity and possible solution domains
9. Xu, H., Thakur, K., Kamruzzaman, A., and Ali, M.L. (2021, January 21). Applications of cryptography in database: A review. Proceedings of the 2021 IEEE International IOT, Electronics and Mechatronics Conference (IEMTRONICS), Virtual.10.1109/IEMTRONICS52119.2021.9422663 ↗
10. A novel statistical technique for intrusion detection systems10.1016/j.future.2017.01.029 ↗
11. Radford, B.J., Apolonio, L.M., Trias, A.J., and Simpson, J.A. (2018). Network traffic anomaly detection using recurrent neural networks. arXiv.
12. AIDIS: Detecting and classifying anomalous behavior in ubiquitous kernel processes10.1016/j.cose.2019.03.015 ↗
13. Croft, R., Newlands, D., Chen, Z., and Babar, M.A. (2021, January 11–15). An empirical study of rule-based and learning-based approaches for static application security testing. Proceedings of the 15th ACM/IEEE International Symposium on Empirical Software Engineering and Measurement (ESEM), Virtual.10.1145/3475716.3475781 ↗
14. Data efficient reinforcement learning and adaptive optimal perimeter control of network traffic dynamics10.1016/j.trc.2022.103759 ↗
15. Cyber security information exchange to gain insight into the effects of cyber threats and incidents10.1007/s00502-015-0289-2 ↗
16. Halimaa, A., and Sundarakantham, K. (2019, January 11–13). Machine learning based intrusion detection system. Proceedings of the 2019 3rd International Conference on Trends in Electronics and Informatics (ICOEI), Tirupati, India.10.1109/ICOEI.2019.8862784 ↗
17. Kus, D., Wagner, E., Pennekamp, J., Wolsing, K., Fink, I.B., Dahlmanns, M., Wehrle, K., and Henze, M.M. (2022, January 19). A false sense of security? Revisiting the state of machine learning-based industrial intrusion detection. Proceedings of the 8th ACM on Cyber-Physical System Security Workshop, San Antonio, TX, USA.10.1145/3494107.3522773 ↗
18. Heaton, J. (2017). An empirical analysis of feature engineering for predictive modeling. arXiv.10.1109/SECON.2016.7506650 ↗
19. Wang, H., Chen, S., Xu, F., and Jin, Y.-Q. (2015, January 26–31). Application of deep-learning algorithms to MSTAR data. Proceedings of the 2015 IEEE International Geoscience and Remote Sensing Symposium (IGARSS), Milan, Italy.10.1109/IGARSS.2015.7326637 ↗
20. Borys, A., Kamruzzaman, A., Thakur, H.N., Brickley, J.C., Ali, M.L., and Thakur, K. (2022, January 6–9). An evaluation of IoT DDoS cryptojacking malware and Mirai Botnet. Proceedings of the 2022 IEEE World AI IoT Congress (AIIoT), Seattle, WA, USA.10.1109/AIIoT54504.2022.9817163 ↗
21. Machine learning and deep learning10.1007/s12525-021-00475-2 ↗
22. Deep learning applications and challenges in big data analytics10.1186/s40537-014-0007-7 ↗
23. Anomaly-based network intrusion detection using denoising autoencoder and Wasserstein GAN synthetic attacks10.1016/j.asoc.2024.112455 ↗
24. Keystroke biometric systems for user authentication10.1007/s11265-016-1114-9 ↗
25. Kamath, C.N., Bukhari, S.S., and Dengel, A. (2018, January 28–31). Comparative study between traditional machine learning and deep learning approaches for text classification. Proceedings of the ACM Symposium on Document Engineering, Halifax, NS, Canada.10.1145/3209280.3209526 ↗
26. Hybrid intelligent systems for detecting network intrusions10.1002/sec.592 ↗
27. Review of deep learning algorithms and architectures10.1109/ACCESS.2019.2912200 ↗
28. Thakur, K., Ali, M.L., Obaidat, M.A., and Kamruzzaman, A. (2023). A systematic review on deep-learning-based phishing email detection. Electronics, 12.10.3390/electronics12214545 ↗
29. A comprehensive review on malware detection approaches10.1109/ACCESS.2019.2963724 ↗
30. Examining flood vulnerability mapping approaches in developing countries: A scoping review10.1016/j.ijdrr.2021.102766 ↗
31. A survey on machine learning techniques for cyber security in the last decade10.1109/ACCESS.2020.3041951 ↗
32. A novel scalable intrusion detection system based on deep learning10.1007/s10207-020-00508-5 ↗
33. Deep learning-based intrusion detection systems: A systematic review10.1109/ACCESS.2021.3097247 ↗
34. Thakur, H.N., Al Hayajneh, A., Thakur, K., Kamruzzaman, A., and Ali, M.L. (2023, January 7–10). A Comprehensive Review of Wireless Security Protocols and Encryption Applications. Proceedings of the 2023 IEEE World AI IoT Congress (AIIoT), Virtual.10.1109/AIIoT58121.2023.10174571 ↗
35. Ljung, L. (2001, January 21). Black-box models from input-output measurements. Proceedings of the 18th IEEE Instrumentation and Measurement Technology Conference. Rediscovering Measurement in the Age of Informatics (Cat. No. 01CH 37188), Budapest, Hungary.
36. Application of deep learning to cybersecurity: A survey10.1016/j.neucom.2019.02.056 ↗
37. Anomaly-based network intrusion detection: Techniques, systems and challenges10.1016/j.cose.2008.08.003 ↗
38. Cloud computing and its security issues10.22496/atct20161210 ↗
39. Intelligent approach to build a Deep Neural Network based IDS for cloud environment using combination of machine learning algorithms10.1016/j.cose.2019.06.013 ↗
40. Ali, M.L., Ismat, S., Thakur, K., Kamruzzaman, A., Lue, Z., and Thakur, H.N. (2023, January 8–11). Network packet sniffing and defense. Proceedings of the 2023 IEEE 13th Annual Computing and Communication Workshop and Conference (CCWC), Las Vegas, NV, USA.10.1109/CCWC57344.2023.10099148 ↗
41. A novel version of k nearest neighbor: Dependent nearest neighbor10.1016/j.asoc.2017.02.020 ↗
42. Pisner, D.A., and Schnyer, D.M. (2020). Support vector machine. Machine Learning, Elsevier.10.1016/B978-0-12-815739-8.00006-7 ↗
43. Increasing the performance of machine learning-based IDSs on an imbalanced and up-to-date dataset10.1109/ACCESS.2020.2973219 ↗
44. Thakur, K., Qiu, M., Gai, K., and Ali, M.L. (2015, January 3–5). An investigation on cyber security threats and security models. Proceedings of the 2015 IEEE 2nd international conference on cyber security and cloud computing, New York, NY, USA.10.1109/CSCloud.2015.71 ↗
45. A deep learning approach for intrusion detection using recurrent neural networks10.1109/ACCESS.2017.2762418 ↗
46. Recent advances in convolutional neural networks10.1016/j.patcog.2017.10.013 ↗
47. Kamruzzaman, A., Thakur, K., Ismat, S., Ali, M.L., Huang, K., and Thakur, H.N. (2023, January 8–11). Social engineering incidents and preventions. Proceedings of the 2023 IEEE 13th Annual Computing and Communication Workshop and Conference (CCWC), Virtual.10.1109/CCWC57344.2023.10099202 ↗
48. An effective combining classifier approach using tree algorithms for network intrusion de-tection10.1007/s00521-016-2418-1 ↗
49. Javaid, A., Niyaz, Q., Sun, W., and Alam, M. (2015, January 3–5). A deep learning approach for network intrusion detection system. Proceedings of the 9th EAI International Conference on Bio-Inspired Information and Communications Technologies (Formerly BI-ONETICS), New York, NY, USA.10.4108/eai.3-12-2015.2262516 ↗
50. A multimodal deep learning method for android malware detection using various features10.1109/TIFS.2018.2866319 ↗
51. Advanced deep-learning techniques for salient and category-specific object detection: A survey10.1109/MSP.2017.2749125 ↗
52. Fundamentals of recurrent neural network (RNN) and long short-term memory (LSTM) network10.1016/j.physd.2019.132306 ↗
53. Dey, R., and Salem, F.M. (2017, January 6–9). Gate-variants of gated recurrent unit (GRU) neural networks. Proceedings of the 2017 IEEE 60th International Midwest Symposium on Circuits and Systems (MWSCAS), Boston, MA, USA.10.1109/MWSCAS.2017.8053243 ↗
54. Deep learning approach for intelligent intrusion detection system10.1109/ACCESS.2019.2895334 ↗
55. Ali, M.L., Thakur, K., and Obaidat, M.A. (2022). A hybrid method for keystroke biometric user identification. Electronics, 11.10.3390/electronics11172782 ↗
56. Effective android malware detection with a hybrid model based on deep autoencoder and convolutional neural network10.1007/s12652-018-0803-6 ↗
57. A novel hybrid surrogate intelligent model for creep index prediction based on particle swarm optimisation and random forest10.1016/j.enggeo.2019.105328 ↗
58. Papernot, N., McDaniel, P., Wu, X., Jha, S., and Swami, A. (2016, January 22–26). Distillation as a defense to adversarial perturbations against deep neural networks. Proceedings of the 2016 IEEE Symposium on Security and Privacy (S.P.), San Jose, CA, USA.10.1109/SP.2016.41 ↗
59. A comprehensive survey on poisoning attacks and countermeasures in machine learning10.1145/3551636 ↗
60. Grosse, K., Papernot, N., Manoharan, P., Backes, M., and McDaniel, P. (2017, January 11–15). Adversarial examples for malware detection. Proceedings of the Computer Security–ESORICS 2017: 22nd European Symposium on Research in Computer Security, Oslo, Norway.10.1007/978-3-319-66399-9_4 ↗
61. Selvam, R., and Velliangiri, S. (2024, January 15–16). An Improving Intrusion Detection Model Based on Novel CNN Technique Using Recent CIC-IDS Datasets. Proceedings of the 2024 International Conference on Distributed Computing and Optimization Techniques (ICDCOT), Bengaluru, India.
62. Sharafaldin, I., Lashkari, A.H., and Ghorbani, A.A. (2025, February 05). CIC-IDS2017 [Data Set]. Kaggle. 2022. Available online: https://www.kaggle.com/datasets/dhoogla/cicids2017.