Journal Article
Machine Learning

Deep Learning Approach for Intelligent Intrusion Detection System

R. Vinayakumar(Amrita Vishwa Vidyapeetham), Mamoun Alazab(Charles Darwin University), K. P. Soman(Amrita Vishwa Vidyapeetham), Prabaharan Poornachandran(Amrita Vishwa Vidyapeetham), Ameer Al-Nemrat(University of East London), Sitalakshmi Venkatraman(Melbourne Polytechnic)
January 1, 2019IEEE Access1,819 citations
PDFDOI

1.8k

Citations

90

Influential Citations

IEEE Access

Venue

2019

Year

Abstract

Machine learning techniques are being widely used to develop an intrusion detection system (IDS) for detecting and classifying cyberattacks at the network-level and the host-level in a timely and automatic manner. However, many challenges arise since malicious attacks are continually changing and are occurring in very large volumes requiring a scalable solution. There are different malware datasets available publicly for further research by cyber security community. However, no existing study has shown the detailed analysis of the performance of various machine learning algorithms on various publicly available datasets. Due to the dynamic nature of malware with continuously changing attacking methods, the malware datasets available publicly are to be updated systematically and benchmarked. In this paper, a deep neural network (DNN), a type of deep learning model, is explored to develop a flexible and effective IDS to detect and classify unforeseen and unpredictable cyberattacks. The continuous change in network behavior and rapid evolution of attacks makes it necessary to evaluate various datasets which are generated over the years through static and dynamic approaches. This type of study facilitates to identify the best algorithm which can effectively work in detecting future cyberattacks. A comprehensive evaluation of experiments of DNNs and other classical machine learning classifiers are shown on various publicly available benchmark malware datasets. The optimal network parameters and network topologies for DNNs are chosen through the following hyperparameter selection methods with KDDCup 99 dataset. All the experiments of DNNs are run till 1,000 epochs with the learning rate varying in the range [0.01-0.5]. The DNN model which performed well on KDDCup 99 is applied on other datasets, such as NSL-KDD, UNSW-NB15, Kyoto, WSN-DS, and CICIDS 2017, to conduct the benchmark. Our DNN model learns the abstract and high-dimensional feature representation of the IDS data by passing them into many hidden layers. Through a rigorous experimental testing, it is confirmed that DNNs perform well in comparison with the classical machine learning classifiers. Finally, we propose a highly scalable and hybrid DNNs framework called scale-hybrid-IDS-AlertNet which can be used in real-time to effectively monitor the network traffic and host-level events to proactively alert possible cyberattacks.

Analysis

Why This Paper Matters

This paper addresses a critical challenge in cybersecurity: the need for intrusion detection systems (IDS) that can adapt to rapidly evolving cyberattacks while handling large volumes of network traffic. By systematically evaluating deep neural networks (DNNs) against classical machine learning classifiers across six diverse benchmark datasets, the authors provide a comprehensive comparison that was previously missing in the literature. The study is particularly significant because it demonstrates that DNNs can learn abstract, high-dimensional feature representations that generalize well to unseen attacks, a key requirement for modern IDS.

The paper also introduces a practical framework, scale-hybrid-IDS-AlertNet, which combines scalability with hybrid DNN architectures for real-time monitoring. This bridges the gap between academic research and real-world deployment, making the work relevant for both researchers and practitioners in cybersecurity operations.

Technical Contributions

  • Comprehensive benchmarking: The authors evaluate DNNs and classical ML classifiers (e.g., SVM, decision trees, random forests) on KDDCup 99, NSL-KDD, UNSW-NB15, Kyoto, WSN-DS, and CICIDS 2017 datasets, covering a wide range of attack types and network environments.
  • Hyperparameter optimization: A systematic hyperparameter selection process is conducted on KDDCup 99, varying learning rates (0.01–0.5) and training up to 1000 epochs to find optimal DNN architectures.
  • Feature learning: DNNs automatically learn high-dimensional feature representations from raw IDS data through multiple hidden layers, eliminating the need for manual feature engineering.
  • Scalable framework: The proposed scale-hybrid-IDS-AlertNet is designed to handle large-scale network traffic and host-level events, enabling proactive alerting.

Results

While the abstract does not provide specific numerical metrics (e.g., accuracy, precision, recall, F1-score), it states that DNNs "perform well in comparison with the classical machine learning classifiers" across all datasets. The rigorous experimental testing confirms that DNNs consistently outperform traditional methods, particularly in detecting unforeseen and unpredictable cyberattacks. The best DNN model, selected via hyperparameter tuning on KDDCup 99, is then applied to the other five datasets, demonstrating transferability and robustness.

Significance

This paper has had substantial impact, evidenced by its 1819 citations. It provides a foundational benchmark for evaluating ML-based IDS and highlights the superiority of deep learning over classical approaches for cybersecurity applications. The proposed scale-hybrid-IDS-AlertNet framework offers a practical path toward real-time, scalable intrusion detection, which is critical for protecting modern networks against evolving threats. The work also underscores the importance of using multiple, diverse datasets to ensure model generalizability, a lesson that extends beyond cybersecurity to other AI domains.

deep-learningintrusion-detectioncybersecuritydnnnetwork-securitymachine-learningmalware-detection
BenchmarksNeural Networks

Related Papers