18th May 2025

202103006

Abbas Al-mutawa

IT-7099
 Cortex Guard
{Cyber Security solution}

A Thesis Presented in

(Partial) Completion of the

Criteria for the Degree of

Bachelor of Information & Communication Technology(Networking)

at
Bahrain Polytechnic
May 2025

2
Title

Developing an Anomaly-Based Network Intrusion Detection System (ANIDS)

Using Deep learning for Detecting Evolving Cyber Threats.

3
Copyright

© 2025
Abbas Al-mutawa All rights reserved

4
Declaration

I hereby declare that this submission is my own work and that, to the best of my
knowledge and belief, it contains no material previously published or written by another
person nor material which to a substantial extent has been accepted for the award of any
other degree or diploma of the university or other institute of higher learning, except
where due acknowledgment has been made in the text.
Signature: Name: Abbas Al-mutawa Date: 18th May 2025

5
 Approval Signatures

APPROVED FOR THE ICT PROGRAMME

________________________________________________
Thesis Supervisor Date:

________________________________________________
Technical Writing Tutor Date:

6
Abstract

The goal of this project was to create an anomaly-based network intrusion detection
system model(ANIDS) that increases security for businesses by discovering new and
changing threats. It seeks to address modern cyberattacks that traditional signature-
based intrusion detection systems (SNIDS) incorporated within network security
frameworks do not detect. Today, modern-day networks (NGN) utilizes SNIDS such as
Snort and Suricata which monitor for threats using pattern matching methodologies.
These systems have serious shortcomings when it comes to dealing with advanced
persistent threats (APTs), zero-day attacks, leaving networks extraordinarily vulnerable.
The model proposes the use of Deep learning with network attack data to detect
anomalies with at least 96% accuracy based on real world scenarios. The model also
supports binary and multi-class classification (DoS, DDoS, and Botnet), which aid in
prioritizing the defending strategies for the cybersecurity teams. The solution comes with
full documentation, written training and evaluation scripts, and offers training and
evaluation metrics but does not provide coverage for deployment while the system is
live. The model is implemented using Python and TensorFlow and is targeted towards
ease of scaling and performance due to optimized GPU utilization, as well as the handling
of data under the provisions of GDPR/CCPA-who’s regulations are ensured to be complied
with. While it does not provide the ability to replace the existing systems on real-time
usage, it's sought function is as a robust framework for future systems integration and
modernization of legacy defenses. In summary, this project seeks to define new gen
defense.

Keywords: Anomaly Detection, Network Security, Intrusion Detection System, Deep

learning, Cybersecurity, TensorFlow, Signature-Based IDS, APTs, Zero-Day Attacks, Binary
Classification, Multi-Class Classification, Threat Detection, Python, NGN, Scalability,
GDPR, CCPA, Artificial Intelligence

7
Acknowledgments

First and foremost, allow me to extend my sincerest appreciation of the support of my

supervisor, Dr. Saeed Al-Samhi. His feedback throughout this project has been
extraordinarily helpful. Dr. Al-Samhi’s knowledge and support helped me to pursue my
goals and exceed what I thought were my limits.

My appreciation, however, also goes to tutors of ICT Faculty in Bahrain Polytechnic, Mr.
Cyril Anthoni, and Dr. Christos Gatzoulis who, at the most crucial juncture, were incredibly
helpful to me. This help was contributing to the growth of my professional intellect and
career readiness, something that I had not anticipated because of how dedicated these
experts were to helping me overcome pain points intellectually.

It needs to be acknowledged that I am most grateful to my parents and family. This

gratitude stems from their support during the most challenging times. Their continuous
support combined with motivational boosts during stressful moments has been very
beneficial throughout the journey.

8
Table of Contents
Introduction .............................................................................................................................. 20

Project Rationale .................................................................................................................. 20

Project objectives ................................................................................................................. 20

Technical Objectives ........................................................................................................ 20

Business Objectives ......................................................................................................... 21

Project related work ............................................................. Error! Bookmark not defined.

Hypothesis ............................................................................................................................ 22

Proposed solution ................................................................................................................. 23

Report Description ............................................................................................................... 24

Background .............................................................................................................................. 25

Related theory ...................................................................................................................... 25

Project Technology ............................................................................................................... 27

Related Work & Literature Review ...................................................................................... 30

Solution design ......................................................................................................................... 32

Architecture diagram............................................................................................................ 32

Activity diagram .................................................................................................................. 34

Use case diagram ................................................................................................................. 36

Actors ............................................................................................................................... 36

Key Process Flows ........................................................................................................... 36

Sequence diagram ................................................................................................................ 38

Design of each model architecture ........................................................................................... 40

Deep neural network ............................................................................................................ 40

Convolutional Neural Network ............................................................................................ 41

Recurrent neural network (LSTM) ...................................................................................... 42

Artificial Neural Network .................................................................................................... 43

Implementation ........................................................................................................................ 44

9
 Obtaining Datasets ............................................................................................................... 44

Data polishing and cleaning (phase 2) ................................................................................. 49

Cleaning script ..................................................................................................................... 52

Combing Script .................................................................................................................... 58

Second cleaning ................................................................................................................... 60

Model creation, training, and testing ....................................................................................... 63

The Data Loading System .................................................................................................... 63

Model Architecture Design .................................................................................................. 64

DNN ................................................................................................................................. 64

LSTM ............................................................................................................................... 65

CNN ................................................................................................................................. 66

ANN ................................................................................................................................. 68

The Experiment Orchestration Function .............................................................................. 70

Setting GPU ......................................................................................................................... 74

Confusion Matrix ................................................................................................................. 80

Evaluation Script .................................................................................................................. 86

Testing ...................................................................................................................................... 89

Test Plan ............................................................................................................................... 89

Participants ........................................................................................................................... 90

Functionality test case and results ........................................................................................ 91

Acceptance Tests Process & Results .................................................................................... 97

Usability testing results and statistics ................................................................................ 100

Discussion, LESPI, and Conclusion ...................................................................................... 110

System functionality .......................................................................................................... 110

Summary of Achieved Objectives...................................................................................... 110

Project issues ...................................................................................................................... 113

Backup plan........................................................................................................................ 114

10
 Future work ........................................................................................................................ 115

Synopsis of my experience ................................................................................................ 115

Bahraini Perspectives ......................................................................................................... 116

Conclusion ......................................................................................................................... 117

Reference list.......................................................................................................................... 118

Appendix I: Administrator and User Manuals ....................................................................... 120

User Manual ....................................................................................................................... 120

Administrator manual ........................................................................................................ 133

Appendix II: Detailed Design ................................................................................................ 134

Appendix III: Detailed Implementation ................................................................................. 138

11
List of Figures
Figure 1 System Architecture Diagram ..................................................................................... 33
Figure 2 Activity Diagram ......................................................................................................... 35
Figure 3 Deep learning Pipeline Use case Diagram.................................................................. 37
Figure 4 Sequence diagram ...................................................................................................... 39
Figure 5 DNN model architecture in pythonDNN Model architecture Diagram: ..................... 40
Figure 6 Visual representation of DNN model architecture ..................................................... 40
Figure 7 CNN model architecture in python ............................................................................ 41
Figure 8 Visual representation of CNN model architectur....................................................... 41
Figure 9 RNN(LSTM) model architecture in python ................................................................. 42
Figure 10 Visual representation of RNN(LSTM) model architecture ..................................... 42
Figure 11 ANN model architecture in python .......................................................................... 43
Figure 12 Visual representation of ANN model architecture ................................................... 43
Figure 13 CSE-CIC-IDS2018 UNB............................................................................................... 44
Figure 14 Install AWS CLI .......................................................................................................... 45
Figure 15 Install AWS 2 ............................................................................................................. 46
Figure 16 Install AWS 3 ............................................................................................................. 46
Figure 17 AW -CLI verification .................................................................................................. 47
Figure 18 pull dataset from s3 ................................................................................................. 47
Figure 19 AWS region list ......................................................................................................... 48
Figure 20 pulling datasets from s3 ........................................................................................... 48
Figure 21 all files ...................................................................................................................... 49
Figure 22 clean files.................................................................................................................. 49
Figure 23 sampling script for large dataset .............................................................................. 50
Figure 24 sampling script usage ............................................................................................... 50
Figure 25 sample of the dataset............................................................................................... 51
Figure 26 cleaning script- Handling invalid entries .................................................................. 52
Figure 27cleaning script- Standardizing timestamps ............................................................... 53
Figure 28 cleaning script- outputting clean data and creating stats file .................................. 53
Figure 29 chatbot-download ollama ........................................................................................ 54
Figure 30 chatbot-chose model ............................................................................................... 54
Figure 31 chatbot-pulling chatbot model ................................................................................ 54

12
Figure 32 deepseek-r1 .............................................................................................................. 55
Figure 33 integrate chatbot into cleaning script ...................................................................... 55
Figure 34 cleaning script output .............................................................................................. 56
Figure 35 cleaning script output 2 ........................................................................................... 56
Figure 36 chatbot functionality ................................................................................................ 57
Figure 37 chatbot functionality 2 ............................................................................................. 57
Figure 38 Combine script 1 ...................................................................................................... 58
Figure 39 Combine script 2 ...................................................................................................... 58
Figure 40 Combine script output 1 .......................................................................................... 59
Figure 41 Combine script output 2 .......................................................................................... 59
Figure 42 Clean binary Class..................................................................................................... 60
Figure 43 Clean binary files ...................................................................................................... 60
Figure 44 Binary stats file ......................................................................................................... 60
Figure 45 Clean Multi Class ...................................................................................................... 61
Figure 46 Clean Multi files ........................................................................................................ 61
Figure 47 Multi stats file ........................................................................................................... 62
Figure 48 Data loading ............................................................................................................. 63
Figure 49 Model Creation (DNN).............................................................................................. 64
Figure 50 Model creation LSTM ............................................................................................... 65
Figure 51 Model creation CNN- 2D format .............................................................................. 66
Figure 52 CNN - convolutional block 1 ..................................................................................... 66
Figure 53 CNN - convolutional block 2 ..................................................................................... 67
Figure 54 Fully Connected Block .............................................................................................. 67
Figure 55 Model creation ANN................................................................................................. 68
Figure 56 Strategic Regularization............................................................................................ 68
Figure 57 ANN output layer ..................................................................................................... 69
Figure 58 experiment function ................................................................................................. 70
Figure 59 Data preparation ...................................................................................................... 71
Figure 60 Stratified sampling ................................................................................................... 71
Figure 61 Training ..................................................................................................................... 72
Figure 62 Metrics ..................................................................................................................... 72
Figure 63 Framework usage ..................................................................................................... 73

13
Figure 64 Feature extraction .................................................................................................... 73
Figure 65 Setting GPU 1............................................................................................................ 74
Figure 66 installing MV C++ ...................................................................................................... 74
Figure 67 pull conda installer ................................................................................................... 75
Figure 68 install mini-conda ..................................................................................................... 75
Figure 69 Virtual environment tf .............................................................................................. 76
Figure 70 VE tf .......................................................................................................................... 76
Figure 71 Cudatool kit and Cudnn ............................................................................................ 76
Figure 72 Cudnn finished installing ......................................................................................... 77
Figure 73 latest Tensorflow gpu version .................................................................................. 77
Figure 74 installing Tensorflow gpu.......................................................................................... 77
Figure 75all packages installed ................................................................................................. 77
Figure 76 Verifying GPU ........................................................................................................... 78
Figure 77 GPU configured successfully ................................................................................... 78
Figure 78 Training Logs ............................................................................................................. 79
Figure 79 Armor Crate .............................................................................................................. 79
Figure 80 CF-1........................................................................................................................... 80
Figure 81 CF-2........................................................................................................................... 81
Figure 82 CF-3........................................................................................................................... 81
Figure 83 CF-4........................................................................................................................... 82
Figure 84 CF-5........................................................................................................................... 83
Figure 85 CF-6........................................................................................................................... 84
Figure 86 CF-7........................................................................................................................... 84
Figure 87 CF-frame work usage................................................................................................ 85
Figure 88 CF-output ................................................................................................................. 85
Figure 89 Mode Evaluation - Data preprocessing .................................................................... 86
Figure 90 Model Evaluation - main part................................................................................... 87
Figure 91 Model evaluation saving the results ........................................................................ 88
Figure 92 Binary class confusion matrix ................................................................................. 101
Figure 93 Multi class confusion matrix .................................................................................. 102
Figure 94 DNN evaluation for Binary class ............................................................................. 103
Figure 95 DNN evaluation for Multi class............................................................................... 103

14
Figure 96 Binary class Confusion Matrix ................................................................................ 105
Figure 97 Multi class Confusion Matrix .................................................................................. 106
Figure 98 LSTM evaluation for Multi class ............................................................................. 107
Figure 99 LSTM evaluation for Binary class ............................................................................ 108
Figure 100 Deep learning Bar graph ...................................................................................... 109
Figure 101 System and User Manuals starting tool ............................................................... 120
Figure 102 System and User Manuals clean all files .............................................................. 121
Figure 103 System and User Manuals cleaning logs .............................................................. 121
Figure 104 System and User Manuals chatbot thinking ........................................................ 122
Figure 105 System and User Manuals chatbot answer .......................................................... 122
Figure 106 exiting clean data ................................................................................................. 123
Figure 107 using specific data clean....................................................................................... 123
Figure 108 cleaning single file ................................................................................................ 123
Figure 109 using Combining ................................................................................................... 124
Figure 110 logs for combining ................................................................................................ 124
Figure 111 combined output.................................................................................................. 125
Figure 112 clean binary class ................................................................................................. 125
Figure 113 cleaning logs ......................................................................................................... 125
Figure 114 output of cleaning binary class ............................................................................ 126
Figure 115 cleaning multiclass ............................................................................................... 126
Figure 116 cleaning logs ......................................................................................................... 126
Figure 117 Multiclass output ................................................................................................. 127
Figure 118 Building an IDS Model .......................................................................................... 127
Figure 119 Model training ...................................................................................................... 128
Figure 120 Model training LSTM ............................................................................................ 128
Figure 121 Lstm model training ............................................................................................. 129
Figure 122 Metrics of LSTM training ...................................................................................... 129
Figure 123 Model Evaluation DNN ......................................................................................... 130
Figure 124 Model evaluation LSTM........................................................................................ 131
Figure 125 LSTM Evaluation results ....................................................................................... 131
Figure 126 DNN confusion matrix .......................................................................................... 132
Figure 127 LSTM confusion matrix ......................................................................................... 132

15
Figure 128 Admin manual...................................................................................................... 133
Figure 129 Activity diagram for Data cleaning ....................................................................... 134
Figure 130 machine-learning pipeline diagram ..................................................................... 135
Figure 131 Phase 2 sequence diagram................................................................................... 136
Figure 132 Model Evaluation ................................................................................................. 137
Figure 133 Detailed Implementation cleaning Script 1 ......................................................... 138
Figure 134 Detailed Implementation cleaning Script 2 ......................................................... 138
Figure 135 Detailed Implementation cleaning Script 3 ......................................................... 139
Figure 136 Detailed Implementation cleaning Script 4 ......................................................... 139
Figure 137 Detailed Implementation cleaning Script 5 ......................................................... 140
Figure 138 Detailed Implementation Combining script 1 ..................................................... 140
Figure 139 Detailed Implementation Combining script 2 ..................................................... 141
Figure 140 Detailed Implementation cleaningv2 Script 1 ..................................................... 141
Figure 141 Detailed Implementation cleaningv2 Script 2 ..................................................... 142
Figure 142 Detailed Implementation DNN model training Script 1 ...................................... 142
Figure 143 Detailed Implementation DNN model training Script 2 ...................................... 143
Figure 144 Detailed Implementation DNN model training Script 3 ...................................... 143
Figure 145 Detailed Implementation DNN model training Script 4 ...................................... 144
Figure 146 Detailed Implementation DNN model training Script 5 ...................................... 144
Figure 147 Detailed Implementation LSTM model training Script 1 .................................... 145
Figure 148 Detailed Implementation LSTM model training Script 2 .................................... 145
Figure 149 Detailed Implementation LSTM model training Script 3 .................................... 146
Figure 150 Detailed Implementation LSTM model training Script 4 .................................... 146
Figure 151 Detailed Implementation LSTM model training Script 5 .................................... 147
Figure 152 Detailed Implementation LSTM model training Script 6 .................................... 147
Figure 153 Detailed Implementation Model evaluation 1 ..................................................... 148
Figure 154 Detailed Implementation Model evaluation 2 ..................................................... 148
Figure 155 Detailed Implementation Model evaluation 3 ..................................................... 149
Figure 156 Detailed Implementation confusion matrix 1 ...................................................... 149
Figure 157 Detailed Implementation confusion matrix 2 ...................................................... 150
Figure 158 Detailed Implementation confusion matrix 3 ...................................................... 150
Figure 159 Detailed Implementation Cortex Guard 1 ........................................................... 151
Figure 160 Detailed Implementation Cortex Guard 2 ........................................................... 151
Figure 161 Detailed Implementation Cortex Guard 3 ........................................................... 152

16
Figure 162 Detailed Implementation Cortex Guard 4 ........................................................... 152
Figure 163 Detailed Implementation Cortex Guard 5 ........................................................... 153
Figure 164 Detailed Implementation Cortex Guard 6 ........................................................... 153

List of tables

17
Table 1- Tasks table .................................................................................................................. 23
Table 2 - table of technologies ................................................................................................. 30
Table 3 Participants in testing .................................................................................................. 91
Table 4 Test scenarios table...................................................................................................... 97
Table 5 Test acceptance table .................................................................................................. 99
Table 6 DNN Metrics table ..................................................................................................... 100
Table 7 LSTM Metrics table .................................................................................................... 104
Table 8 Final Comparison DNN............................................................................................... 109
Table 9 Summary of Achieved Objectives .............................................................................. 112
Table 10 Project issues table ................................................................................................. 114

List of Abbreviations

18
 Abbreviation Full Form
AI Artificial Intelligence
ANN Artificial Neural Network
ANIDS Anomaly-Based Network Intrusion Detection System
APT Advanced Persistent Threat
AWS Amazon Web Services
CNN Convolutional Neural Network
CCPA California Consumer Privacy Act
CSV Comma-Separated Values
DDoS Distributed Denial of Service
DL Deep Learning
DNN Deep Neural Network
DoS Denial of Service
GDPR General Data Protection Regulation
GPU Graphics Processing Unit
IDS Intrusion Detection System
KDD Knowledge Discovery in Databases
LSTM Long Short-Term Memory
DL Deep learning
NGN Next Generation Network
PCA Principal Component Analysis
RNN Recurrent Neural Network
SNIDS Signature-Based Network Intrusion Detection System
TF TensorFlow
VE Virtual Environment
Table 1 table of abbreviations

19
 Introduction
Project Rationale
The effectiveness of traditional signature-based intrusion detection systems (SNIDS), such
as Snort and Suricata, has continued to be ineffective in defending modern networks. The
systems rely on pre-established detection patterns, which categorize malicious activity
into predefined templates. This dependence limits the effectiveness of such systems to
identify 'attacks' and threats, hence exposing cybersecurity firms, including NGN, to
enormous risks.

The techniques used in cyber-attacks and how they are leveraged are continually
changing, thus making them dynamic problems to counter. Attackers will often make
small changes to their tactics to avoid detection, hence compromising the effectiveness
of signature-based systems. These systems do not have the ability to identify patterns
that are outside normative behavior, hence their inability to identify slow, well-designed
multi-stage attacks. These sophisticated methods reduce their effectiveness in stopping
advanced threat actors who make a conscious effort to remain undetected.

Project objectives
The main goal of this project is to develop, train, and evaluate a Deep learning-based
Anomaly-Based Intrusion Detection System (ANIDS). The system will improve
cybersecurity through detecting new and emerging threats that cannot be caught by
traditional signature-based systems.

Technical Objectives
➢ Develop a Deep learning-Based IDS Model
o Build an anomaly detection model using Python, Keras, and TensorFlow.
o Train the model on real-world labeled network traffic to identify both normal
and attack patterns.
➢ Achieve High Detection Accuracy
o Ensure the model reaches a minimum of 96% accuracy in detecting
anomalies.

20
 o Maintain a low false positive rate through proper tuning and validation.
➢ Support Multi-Class Classification
o Enable the model to differentiate between multiple attack types such as DoS,
DDoS, and Botnet.
o Use well-structured datasets to train and test multi-class outputs effectively.
➢ Document and Evaluate Model Performance
o Generate detailed evaluation reports including accuracy, precision, recall,
and F1-score.
o Ensure technical documentation covers model architecture, dataset
handling, and training procedures.

Business Objectives
➢ Enhance Organizational Cybersecurity Posture
o Provide NGN with an advanced detection capability for modern threats like
APTs and zero-day attacks.
o Reduce reliance on outdated SNIDS solutions that detect only known attacks.
➢ Support Scalable and Future-Ready Security Systems
o Design the model for future integration with NGN’s live cybersecurity
infrastructure.
o Ensure the system is GPU-efficient and scalable for high-volume
environments.
➢ Improve Operational Efficiency
o Reduce manual alert investigations by minimizing false positives.
o Empower cybersecurity teams with intelligent detection insights for faster
response.
➢ Ensure Compliance and Ethical Data Use
o Handle all data according to GDPR and CCPA regulations through encryption
and anonymization.
o Follow ethical AI development practices and maintain transparency in
o detection logic.
o

21
 Prior Work
The most relevant study to this project is the work of Talukder et al. (2024), titled "Deep
learning-based network intrusion detection for big and imbalanced data using
oversampling, stacking feature embedding and feature extraction", published in the
Journal of Big Data. Their research presents a comprehensive approach to building Deep
learning-based intrusion detection systems, addressing key challenges such as data
imbalance, dimensionality, and detection accuracy. The study uses a wide range of
techniques including Random Oversampling (RO), Stacked Feature Embedding, and
Principal Component Analysis (PCA), and it evaluates performance on multiple
benchmark datasets such as CIC-IDS-2017, CIC-IDS-2018, and UNSW-NB15.

Although our project shares a similar goal developing an anomaly-based intrusion

detection system using machines to learn the direction and intent differ. Talukder et al.'s
work is oriented more towards academic exploration, focusing on comparative
performance metrics across various techniques and datasets. It contributes to the
research community by exploring the theoretical boundaries and combinations of
multiple methods.

In contrast, this project is focused on delivering a streaDLined, accurate, and

operationally feasible solution that is designed for potential real-world deployment.
Instead of exploring many algorithms and datasets, our approach emphasizes practicality,
interpretability, and achieving high detection accuracy on well-defined and manageable
datasets. Additionally, while the study by Talukder et al. extensively analyzes
performance across multiple configurations, it does not focus on preparing the system
for integration into a real-world security environment as a key consideration in this
project.

Hypothesis
This paper hypothesizes that the proposed anomaly-based intrusion detection system
(ANIDS) using Deep learning is more effective and accurate than traditional signature-
based systems in detecting evolving cyber threats. The proposed model focuses on

22
 identifying unknown attacks with high precision and minimal false positives. It is also
expected to deliver scalable, efficient, and GDPR-compliant results suitable for future
operational deployment. Therefore, the expected outcome is a secure, intelligent, and
high-performance detection system that meets modern cybersecurity demands.
Proposed solution
The limitations of traditional signature-based intrusion detection systems, such as their
inability to detect unknown or evolving threats, require a more adaptive approach. This
project proposes an anomaly-based intrusion detection system (ANIDS) built using Deep
learning. The model is trained on real-world network traffic data to accurately detect
abnormal behavior, including zero-day attacks and APTs.

The system will support both binary and multi-class classification and is designed to
achieve at least 96% detection accuracy. Built with Python and TensorFlow, it emphasizes
scalability, performance, and data compliance. Although live deployment is outside the
current scope, the solution includes all necessary scripts, evaluation reports, and
documentation for future operational use.

Tasks
• Collect, preprocess, and combine real-world network traffic datasets
• Develop and train anomaly-based IDS model using TensorFlow
• Evaluate model performance using accuracy, precision, recall, and F1-score
• Document architecture, training process, and prepare scripts for future
deployment
Table 2- Tasks table

23
 Report Description
In the next sections of this paper, there will be an exhaustive examination of the solution;
in depth, discussion on all the aspects is included. Each section outlines a specific sub-
topic that needs to be deliberated by summarizing the steps taken during the project.
Starting with the Background section which will explain prerequisite knowledge for some
technical jargons alongside overview information on the technologies which were used.
Then comes the Requirement and Design Section, which emphasizes basic design
requirements and outlines their methodologies. This section also covers the design
strategy of the product under consideration. Then comes the Implementation section; it
is devoted to explaining building and implementing the product in detail. The fourth is
the Testing section, which is the most significant one because it incorporates all the
methods selected to validate the product and ensure its efficiency. The last part,
Discussion and Conclusion, captures all the objectives set at the beginning alongside any
hurdles faced during the project. It suggests some ways for augmenting the project in the
future. It will also contain LESPI and reflection on the obtained experience.

24
 Background
Related theory
The security of digital networks is a critical concern for organizations, as modern
infrastructures face increasingly sophisticated cyber threats. Intrusion Detection Systems
(IDS) are designed to identify and respond to malicious activities within network traffic.
Traditional Signature-Based IDS (SNIDS), such as Snort and Suricata, rely on known attack
patterns to detect threats. While effective against known attacks, these systems are
limited in identifying unknown or evolving threats like zero-day exploits and Advanced
Persistent Threats (APTs) (Axelsson, 2000; Scarfone & Mell, 2007).
To address this limitation, Anomaly-Based Intrusion Detection Systems (ANIDS) have
emerged as an alternative. These systems monitor deviations from normal network
behavior and flag unusual activity as potential threats. The integration of Deep learning
has significantly enhanced the accuracy and adaptability of anomaly detection systems
(Chandola, Banerjee & Kumar, 2009).
Among the most effective Deep learning techniques for ANIDS are deep learning models.
Artificial Neural Networks (ANN) form the foundation of these approaches by simulating
the way the human brain processes information. Deep Neural Networks (DNN) expand
on this by adding multiple hidden layers to improve learning of complex patterns.
Convolutional Neural Networks (CNN) are particularly useful for extracting spatial
features from structured data, while Recurrent Neural Networks (RNN), especially Long
Short-Term Memory (LSTM) networks, are adept at analyzing sequential data, such as
time-based network traffic flows. These models have shown promising results in
detecting sophisticated attack patterns across various benchmark datasets (Javaid et al.,
2016; Vinayakumar et al., 2019).

Overall, this paper focuses on the theory of anomaly detection using deep learning,
applying ANN, DNN, CNN, and RNN (LSTM) to build a high-accuracy IDS model. The next
sections explain the implementation and evaluation methods used to validate the
proposed solution.

25
 ➢ AI in cybersecurity
Artificial Intelligence (AI) has emerged as a pivotal technology in the field of
cybersecurity, offering advanced solutions for defending against evolving threats.
AI’s ability to process vast amounts of data in real time and recognize complex
patterns makes it an ideal tool for detecting, analyzing, and mitigating cyber threats.
One of the most significant contributions of AI in cybersecurity is in the area of
predictive analytics. By using Deep learning algorithms, AI can predict potential
security breaches by analyzing historical data and identifying patterns that could
signify an impending attack. Moreover, AI can adapt and evolve its threat detection
capabilities over time, improving its accuracy and reducing the number of false
positives. The AI-driven systems are also capable of detecting and mitigating
sophisticated attacks, such as Advanced Persistent Threats (APTs) and zero-day
attacks, which are often undetectable by traditional signature-based systems.

➢ Deep learning and Anomaly Detection

Deep learning (DL) plays a vital role in anomaly detection by identifying unusual
patterns or behaviors in data that may indicate potential cybersecurity threats. Unlike
traditional methods that rely on predefined rules, DL algorithms can learn from
historical data and adapt over time, making them more effective at detecting
previously unknown threats.

In anomaly detection, supervised learning uses labeled data to classify normal versus
abnormal behavior, while unsupervised learning detects anomalies without labeled
data by identifying outliers or unusual patterns. Deep learning models like Recurrent
Neural Networks (RNNs) and Autoencoders excel at recognizing complex patterns in
high-dimensional data, such as network traffic or user behavior.

These DL-powered systems are particularly useful for identifying advanced threats,
like zero-day attacks or Advanced Persistent Threats (APTs), which are difficult to
detect with traditional methods. Deep learning models continuously analyze real-time
data, flagging deviations from normal behavior and helping security teams respond
quickly to emerging threats. By enhancing anomaly detection capabilities, Deep
learning improves the accuracy and speed of cybersecurity defenses, making it an
essential tool in modern threat detection systems.

26
➢ Data Analysis in Cybersecurity

Data analysis in cybersecurity involves processing and examining large volumes of data
from sources like network logs, user activities, and system events to identify potential
security threats. By applying techniques such as statistical analysis, Deep learning, and
pattern recognition, security teams can detect abnormal behaviors or patterns that indicate
attacks, such as data breaches, malware infections, or insider threats. Analyzing this data
helps uncover hidden vulnerabilities and provides real-time insights into ongoing threats,
enabling quicker, more informed decision-making. Effective data analysis strengthens
proactive cybersecurity measures, enhancing the ability to prevent, detect, and respond to
cyber incidents.

Project Technology
This section is crucial to grasp, as the proposed solution relies heavily on a range of
technologies. These technologies including services, hardware, and software will be
detailed comprehensively in the following table.

Technology Purpose
Programming Languages & Libraries
Core programming language used in the project
for implementing scripts, data processing, and
Deep learning models. Chosen for its simplicity,
versatility, and robust libraries that support data
analysis and Deep learning tasks.
Python library used for data manipulation and
analysis, particularly for handling CSV files, data
cleaning, and preprocessing in the data cleaning
scripts.
Deep learning library providing tools for data
preprocessing, model selection, and evaluation
metrics (precision_score, recall_score,
f1_score).
Deep learning Framework & Tools

27
 Deep learning framework used to build, train
and evaluate neural network models including
Dense Neural Networks (DNN), Convolutional
Neural Networks (CNN), and Long Short-Term
Memory (LSTM) networks, Artificial Neural
Network (ANN).
Visualization tool used for tracking and
visualizing metrics during model training,
helping analyze model performance with logs
stored in specific directories.
Stratified Shuffle Split Cross-validation technique implemented using
scikit-learn to ensure representative
distribution of classes in training and testing
sets.
Deep learning Models
Dense Neural Network (DNN) A fully connected feedforward neural network
used for classifying network traffic into benign
or attack categories. It serves as a baseline deep
learning architecture.
Convolutional Neural Network A neural network architecture that uses
(CNN) convolutional layers to automatically extract
spatial features from reshaped network traffic
data, improving detection accuracy.
Long Short-Term Memory (LSTM) A type of recurrent neural network capable of
learning long-term dependencies in sequential
data. Used to capture temporal patterns in
network traffic for enhanced anomaly
detection.
Artificial Neural Network (ANN) A general category of interconnected
neuron-based models used in classification
tasks, forming the foundation for more

28
 specialized architectures like DNNs, CNNs, and
LSTMs.
Data Processing & Infrastructure
Data Cleaning Scripts Custom Python scripts for preprocessing raw
network traffic data, including handling invalid
values, converting dates to Unix timestamps,
and organizing data by categories.
Label Encoding Technique used to convert categorical labels
into numerical format suitable for Deep learning
models.
Normalization Data preprocessing technique applied to scale
feature values for optimal model training. A
preprocessing step to scale numerical features
to a common range, typically between 0 and 1,
to ensure efficient and stable model training.
Ollama A locally hosted language model used to
generate human-readable explanations of the
data cleaning process through a chatbot
interface, enhancing system transparency and
user understanding.
Model optimization and enhancements
Hyperparameter Tuning The process of selecting the optimal
configuration for a Deep learning model (e.g.,
learning rate, batch size, number of epochs) to
improve performance and generalization.
Feature Extraction The process of selecting and transforming
relevant input variables (features) that
contribute significantly to model accuracy. It
reduces dimensionality and highlights
meaningful patterns in the data.

29
 Threshold Tuning Adjusting the decision threshold of a classifier to
optimize performance metrics like precision,
recall, and F1-score, especially critical in
imbalanced classification problems.
Table 3 - table of technologies

Related Work & Literature Review

This section explores the existing research related to intrusion detection and the
application of Deep learning in cybersecurity. Since the primary goal of this paper is to
develop an anomaly-based intrusion detection system (ANIDS) using Deep learning, the
related work is divided into two focused areas.

➢ Intrusion Detection
Intrusion detection has long been a foundational aspect of network security. Traditionally,
organizations have relied on Signature-Based Intrusion Detection Systems (SNIDS), which
compare network traffic against a database of known attack patterns. Tools-like Snort and
Suricata have been widely adopted for this purpose. However, as highlighted by Axelsson
(2000), these systems are only effective against previously identified threats and fail to
detect zero-day exploits and advanced persistent threats (APTs). This reactive approach
creates a critical gap in network defense.
Recent studies, such as the work of Scarfone and Mell (2007), have emphasized the
importance of real-time monitoring and anomaly detection to supplement SNIDS. Their
findings show that anomaly-based systems can identify deviations from normal network
behavior, potentially catching unknown threats. While traditional systems continue to be
used in operational environments due to their reliability and simplicity, their limited
adaptability to new threats is a significant drawback when compared to newer methods.
This paper builds on the direction of anomaly detection but with more focus on using
real-world datasets and improving detection accuracy through Deep learning.

➢ Introducing Deep learning to the Cybersecurity Realm

30
 In the last decade, the integration of Deep learning into cybersecurity has transformed
how threats are detected and handled. Deep learning models offer the capability to learn
from data and generalize to detect unseen attacks. According to Chandola, Banerjee, and
Kumar (2009), anomaly detection through Deep learning enables systems to identify
patterns that differ from normal behavior without relying on explicit attack signatures.
Deep learning models such as Artificial Neural Networks (ANN), Convolutional Neural
Networks (CNN), Recurrent Neural Networks (RNN), and Long Short-Term Memory
(LSTM) have been applied with promising results. Research by Javaid et al. (2016) used
deep neural networks to detect intrusions with high accuracy, outperforming traditional
statistical methods. Furthermore, Vinayakumar et al. (2019) demonstrated that LSTM
networks could model temporal dependencies in network traffic, making them highly
effective for real-time anomaly detection.
However, many of these studies focus on academic evaluations with multiple datasets
and complex models, as seen in the work of Talukder et al. (2024), which, while
comprehensive, is more research-oriented than practical. In contrast, this paper adopts
a focused approach that prioritizes a balance between accuracy, simplicity, and future
deploy ability, using TensorFlow and Python to build a practical yet effective anomaly
detection model.

31
 Solution design
This section outlines the design methodologies used to develop the anomaly-based
intrusion detection system. Before implementation, careful consideration was given to
algorithm selection, data preprocessing techniques, and system architecture. Design
tools such as flowcharts and UDL diagrams were used to visualize the system’s operation
flow. Additionally, suitable data structures and deep learning model architectures were
selected to ensure accuracy, scalability, and efficient training and evaluation.

Architecture diagram
The system architecture outlines the complete workflow of building and evaluating an
anomaly-based intrusion detection system using Deep learning. It begins with data
preparation, where seven datasets are cleaned (Script 1), combined (Script 2), and
refined
(Script 3) to produce both binary and multi-class datasets. These datasets are then used
to train and test four types of deep learning models DNN, LSTM, CNN, and ANN each
through dedicated scripts (Scripts 4 to 7).
For every model, separate versions are trained for binary and multi-class classification.
The outputs of these training processes are evaluated using confusion matrices,
generated automatically by Script 8. This final step provides insight into each model’s
performance, enabling comparisons in terms of accuracy, false positives, and overall
effectiveness. The architecture ensures a structured and modular approach, supporting
flexibility, scalability, and clarity in the implementation process.

32
Figure 1 System Architecture Diagram

33
 Activity diagram
This activity diagram illustrates a Deep learning workflow for model training and
evaluation. The process begins at the "Start" node and proceeds through several key
phases:
1. Data preparation: Raw datasets are loaded and validated. If validation fails, data
issues are fixed. Once valid, feature extraction and preprocessing occur, with
parameters adjusted if needed.
2. Dataset creation: The workflow branches into binary and multi-class classification
paths, each with its own feature normalization and train/test split processes.
3. Parallel model training: Four different neural network architectures (DNN, LSTM,
CNN, and ANN) are trained simultaneously.
4. Model evaluation: A convergence check determines next steps. If models haven't
converged, hyperparameters are adjusted. If converged, confusion matrices and
performance metrics are calculated for model comparison.
5. Model selection: The workflow evaluates if the best model is satisfactory. If not
satisfactory, the process either requests more data (returning to data loading) or
tries different architectures (returning to model training).
6. Finalization: Once a satisfactory model is selected, it's exported, results are
documented, and the process ends.
The diagram shows multiple decision points (diamond shapes) controlling the flow
between activities, with feedback loops allowing for iterative improvement at various
stages. The overall structure emphasizes systematic evaluation and refinement until
achieving optimal model performance.

34
 Deep learning pipeline system

Figure 2 Activity Diagram

35
 Use case diagram
This use case diagram illustrates a comprehensive Deep learning Pipeline System with
three main actors interacting with various components.
The diagram shows:
Actors

• Data Analyst: Handles data collection and preparation activities

• DL Engineer: Manages technical infrastructure and training setup
• Domain Expert: Provides domain knowledge and validation

Key Process Flows

1. Data Processing Flow: Starting with data collection, proceeding through preparation
(combining, cleaning, splitting datasets), and involving dataset validation
2. Training Infrastructure Flow: The DL Engineer configures the training environment
through GPU allocation and dynamic training protocol optimization
3. Model Development Flow: Including neural network model training, parameter
configuration, and hyperparameter fine-tuning
4. Output and Evaluation Flow: Producing trained models for export, generating
confusion matrices, visualizing and comparing model performance

The relationships between components are shown through different connection types:

• «include» relationships (solid lines): Representing mandatory sub-processes

• «extend» relationships (dashed lines): Representing optional extensions
• «invokes» relationships (dashed lines): Showing triggering relationships

The diagram effectively captures the end-to-end Deep learning lifecycle from data acquisition
to model evaluation, highlighting the collaborative roles of different specialists throughout
the process.

36
Figure 3 Deep learning Pipeline Use case Diagram

37
 Sequence diagram
This sequence diagram illustrates the Deep learning pipeline workflow across six key
components: Data Scientist, Data Preprocessing, Feature Concatenation, Feature
Normalization, Model Training, and Model Evaluation.
The workflow progresses through several scripts:
1. Script 1 (Feature Extraction & Preprocessing): The Data Scientist initializes datasets,
followed by extracting features, removing outliers, handling missing values, and
normalizing features.
2. Script 2 (Feature Concatenation & Label Engineering): Features are concatenated,
labels are engineered, and stratification is performed, returning binary and multi-
class datasets.
3. Script 3 (Feature Normalization & Dimensionality Reduction): Data scaling is applied,
dimensions are reduced, and train/test splits are created.
4. Scripts 4-7 (Neural Network Model Training): Four different neural network
architectures (DNN, LSTM, CNN, ANN) are trained in parallel, with each model
receiving both binary and multi-class datasets.
5. Script 8 (Performance Metrics & Confusion Matrices): Predictions are made, metrics
calculated, confusion matrices generated, and performance compared.
The process concludes with the Data Scientist evaluating results and selecting the optimal
model. The diagram clearly shows the sequential flow of data and control between
components, with dotted lines representing method calls and solid arrows showing
returns between the different system components.

38
 Figure 4 Sequence diagram

39
 Design of each model architecture
The architecture of a neural network is a critical component in the development of any
Deep learning model, particularly in deep learning. It defines how data flows through the
network, how features are extracted, and how predictions are made.

Deep neural network

A Deep Neural Network (DNN) consists of multiple hidden layers between the input and
output layers. Each layer is made up of interconnected neurons that apply weights and
activation functions to learn complex patterns in data. In anomaly detection, DNNs are
effective at capturing nonlinear relationships and subtle anomalies that simpler models
might miss, making them a powerful tool for identifying advanced cyber threats.

DNN Model architecture in code:

Figure 5 DNN model architecture in pythonDNN Model architecture Diagram:

Figure 6 Visual representation of DNN model architecture

40
 Convolutional Neural Network
A Convolutional Neural Network (CNN) is a type of deep learning model designed to
automatically and adaptively learn spatial hierarchies of features through convolutional
layers. While CNNs are widely used in image processing, they are also effective in
cybersecurity tasks like intrusion detection by capturing local patterns in data. CNNs use
filters to extract features, followed by pooling and fully connected layers, making them
powerful for recognizing complex structures in input data.

CNN Model architecture in code:

Figure 7 CNN model architecture in python

CNN Model architecture Diagram

Figure 8 Visual representation of CNN model architectur

41
 Recurrent neural network (LSTM)
Long Short-Term Memory (LSTM) is a special type of Recurrent Neural Network (RNN)
designed to handle sequential data and remember long-term dependencies. Unlike
traditional RNNs, LSTMs use gates to control the flow of information, making them highly
effective at learning patterns over time. They are widely used in time-series analysis,
natural language processing, and can also be applied in cybersecurity to detect patterns
in sequences of network activity or logs.
RNN(LSTM) Model architecture in code:

Figure 9 RNN(LSTM) model architecture in python

RNN(LSTM) Model architecture Diagram:

Figure 10 Visual representation of RNN(LSTM) model architecture

42
 Artificial Neural Network
An Artificial Neural Network (ANN) is a computational model inspired by the structure of
the human brain. It consists of layers of interconnected neurons that process input data
to learn patterns and make predictions. ANNs are the foundation of most deep learning
models and are widely used for tasks like classification, regression, and anomaly
detection. Their ability to model complex relationships makes them valuable in
cybersecurity for identifying unusual or malicious activity.
ANN Model architecture in code:

Figure 11 ANN model architecture in python

ANN Model architecture Diagram:

Figure 12 Visual representation of ANN model architecture

43
 Implementation
This section outlines the practical steps taken to develop the Anomaly-Based Network
Intrusion Detection System (ANIDS). It covers the preprocessing of network traffic datasets,
the design of the Deep learning model using TensorFlow, and the training and evaluation
procedures for both binary and multi-class classification tasks. The implementation focuses
on achieving high accuracy in detecting unknown and evolving cyber threats.

Obtaining Datasets
In this phase I started searching for a well-balanced dataset that contains a huge number
of network traffic between benign and attacks and based on real life attacks, after
searching in the wild I found CSE-CIC-IDS-2018 is widely used in Deep learning research
projects due to the many benefits present in its structure.

Figure 13 CSE-CIC-IDS2018 UNB

I found it on the University of New Brunswick website.

As you scroll down there are instructions on how to obtain the data set from the aws-S3
storage.

44
 First I downloaded AWS cli.

Figure 14 Install AWS CLI

45
 Figure 15 Install AWS 2

Figure 16 Install AWS 3

46
 Verify AWS CLI installed from CMD.

Figure 17 AW -CLI verification

Figure 18 pull dataset from s3

Now we will use this command and get the region using the AWS regions list link.

47
 Figure 19 AWS region list

We got the code of the region from this list.

Figure 20 pulling datasets from s3

48
After pulling 220 GB of raw network packets, logs and datasets in csv files after cleaning and
taking what we need from the s3 storage I deleted the rest of the content to save storage.

Figure 21 all files

Figure 22 clean files

First phase is done next phase is Data polishing and cleaning.

Data polishing and cleaning (phase 2)

To start we must study the structure of the dataset and follow a guide on how to clean it
and process it because this part is very important to allow proper training and testing in
later phases.
To start with we can’t open the datasets normally. It will take a lot of time due to its large
size so I wrote a script to extract a sample from the dataset.

49
 Figure 23 sampling script for large dataset

This is how to use it.

Figure 24 sampling script usage

As we can see we can now open a sample of the dataset easily.

50
 Figure 25 sample of the dataset

So, after diving into the dataset, I noticed a few things that needed immediate attention
to get it into a usable state. Here's the cleaning process I implemented based on my initial
examination:
1. Handling Invalid Entries: I spotted rows that were clearly not valid data points.
Specifically, any row starting with a 'D' or containing the string 'Infinity' (in any case)
seemed to represent errors or irrelevant information. These rows were flagged for
removal to ensure the integrity of the analysis.
2. Standardizing Timestamps: The timestamp format in the third column was
inconsistent or not in a numerical format suitable for analysis. To address this, I
decided to convert all valid date entries into Unix timestamps. This provides a
consistent numerical representation of time, making it easier for Deep learning
models to process. Any rows where the date parsing failed were also marked for
removal.
3. Organizing by Attack Type: The last column of the dataset contains the labels
indicating the type of network traffic (benign or specific attacks). To better
understand the distribution of different traffic types and potentially train more
targeted models later, I decided to group the cleaned data based on these labels.
This involved creating separate files for each unique label.
4. Generating Summary Statistics: To keep track of the cleaning process and
understand its impact, I implemented the generation of a statistics file. This file

51
 summarizes the total number of clean rows, the count of rows that were dropped
due to invalid data or parsing errors, and the number of rows belonging to each
traffic type.

This cleaning approach ensures that we're working with a dataset free of obvious errors,
with a standardized representation, and organized in a way that facilitates further
analysis and modeling based on the different traffic categories.

Cleaning script
So, I wrote a cleaning script based on the points I mentioned earlier. The whole script will
be referred to in the appendix here I will only display main parts of the script.

Figure 26 cleaning script- Handling invalid entries

52
 Figure 27cleaning script- Standardizing timestamps

Figure 28 cleaning script- outputting clean data and creating stats file

Adding a chatbot model to the script

First download Ollama.

53
 Figure 29 chatbot-download ollama

Then I searched for deepseek-r1 model trained with 7billion variables.

Figure 30 chatbot-chose model

Pull the model.

Figure 31 chatbot-pulling chatbot model

Verify we have the model on our machine.

54
 Figure 32 deepseek-r1

Now we will call the model in the script and use it to answer questions about the cleaning
process.

Figure 33 integrate chatbot into cleaning script

Now we will run the script and see how it works and verify the functionality.

55
 Figure 34 cleaning script output

The following figure illustrates the output of the cleaning script. It cleans the file and
extracts labels and creates several csv files which contains only packets of the labeled
traffic finally a stats file that summarize the cleaning process and the labeled packets.

Figure 35 cleaning script output 2

Chatbot functionality first prompts you for a question.

56
 Figure 36 chatbot functionality

Then it starts by thinking then it answers the question in detail.

Figure 37 chatbot functionality 2

57
 Combing Script
In this part I continue to combine the datasets and split them into a binary class and multi
class this code snippets shows the primary functionality of the combine script.

Figure 38 Combine script 1

This code reads multiple CSV files from a specified folder, starting with the first one, then
checks and appends the rest into a single combined Data Frame while handling missing
files with warnings.

Figure 39 Combine script 2

58
 This code shuffles the combined Data Frame, saves it as a multiclass file (CSV and pickle),
then converts the labels into binary classes (Benign = 0, all attacks = 1) for binary
classification.

Figure 40 Combine script output 1

After running the tool this would be the output on the terminal updating the user on
which operation is the script performing in the current time.

Figure 41 Combine script output 2

59
 This is the product combining tool four files 2 binary csv and pickle, and 2 multiclass csv
and pickle.

Second cleaning
In this step we will clean the Binary-class and multi-class csv files using a slightly edited
version of the cleaning script.
Binary-class

Figure 42 Clean binary Class

Figure 43 Clean binary files

Figure 44 Binary stats file

60
 This script cleaned the csv again after combining and produced several csv files based on
packet labels and stats file that summarizes the contents of the cleaned csv file.

Multi-class

Figure 45 Clean Multi Class

Figure 46 Clean Multi files

61
 Figure 47 Multi stats file

62
 Model creation, training, and testing
How I Developed My Neural Network Framework for Network Traffic Classification.
The Data Loading System

When developing this framework, I first needed a reliable way to handle data loading. I
created the loadData function with caching to avoid repeated parsing of large CSV files:

Figure 48 Data loading

I implemented this caching mechanism because network traffic datasets can be quite
large and repeatedly loading them from CSV would slow down my experimentation cycle.
The pickle format preserves all Data Frame properties while loading much faster. I also
added data cleaning steps (dropping NA values and shuffling) right in this function to
ensure consistent preprocessing across experiments.

63
 Model Architecture Design

For the model architecture, I created a function that defines a three-layer neural network. I
specifically chose a structure that increases the hidden layer size from 79 to 128 nodes before
the output layer:

DNN

Figure 49 Model Creation (DNN)

64
 LSTM
When creating this updated version of my neural network architecture, I made a
significant shift from standard dense layers to LSTM (Long Short-Term Memory) layers.
Here's how I approached this change and why I made these specific design choices:

Figure 50 Model creation LSTM

I replaced the previous Dense layers with an LSTM layer for several reasons. LSTM networks
excel at capturing temporal dependencies in data, which can be valuable even when working
with network traffic features that might have sequential characteristics. Even though our data
isn't inherently sequential in its raw form, I used a time_steps = 1 approach to reshape our
input data into the 3D format (samples, time steps, features) that LSTM requires.

I selected 100 units for the LSTM layer after experimenting with different architectures. This
number provides sufficient capacity to learn patterns in the network traffic data without
becoming too computationally expensive. The LSTM layer inherently maintains an internal
state that can potentially capture more complex relationships than multiple dense layers.

65
CNN
When developing this advanced version of my neural network framework, I made a
significant architectural shift from standard dense neural networks to a Convolutional
Neural Network (CNN) approach. Here's how I designed this model architecture and the
reasoning behind each component:

Figure 51 Model creation CNN- 2D format

I began with a critical transformation - reshaping the flat feature vectors into 2D "image-like"
data. This was a deliberate design choice based on research showing that network traffic
features, when arranged in a 2D grid, can reveal spatial patterns that CNNs excel at detecting.
By taking the square root of the input dimension and reshaping to a square matrix with a
single channel, I'm essentially treating our network traffic data as if it were a grayscale image.

This approach allows the convolutional layers to potentially discover relationships between
adjacent features that might not be apparent in a flat representation. The 2D structure
creates an opportunity for the model to learn hierarchical patterns similar to how CNNs
process images.

Figure 52 CNN - convolutional block 1

For the first convolutional block, I chose 32 filters with a 3×3 kernel size to extract low-level
features from our reshaped data. The 'same' padding preserves the spatial dimensions,
ensuring no information is lost at the edges of our feature matrix. ReLU activation introduces
non-linearity while remaining computationally efficient.

I included Batch Normalization to stabilize and accelerate training by normalizing the

activations of the previous layer. This helps address internal covariate shift and allows higher
learning rates.

The Max Pooling layer reduces the spatial dimensions by half, which both reduces
computation and helps the network focus on the most important features. I added a
moderate Dropout rate of 0.25 to prevent overfitting, which is particularly important when

66
working with network security datasets that might have strong patterns that shouldn't be
memorized.

Figure 53 CNN - convolutional block 2

The second convolutional block doubles the number of filters to 64, which allows the network
to learn more complex and abstract patterns. This progressive widening of the network is a
standard practice in CNN design, as deeper layers need to represent increasingly complex
features.

I maintained the same kernel size, padding, and activation function for consistency. The
second round of Batch Normalization, Max Pooling, and Dropout follows the same rationale
as the first block, creating a deeper hierarchy of features while managing overfitting.

Figure 54 Fully Connected Block

After extracting features with convolutional layers, I transition to fully connected layers for
classification. The Flatten layer converts the 2D feature maps into a 1D vector that can be
processed by dense layers.

I selected 128 neurons for the dense layer to provide sufficient capacity for learning complex
relationships between the extracted features. The higher dropout rate of 0.5 is intentional
here - fully connected layers have more parameters and are more prone to overfitting, so
stronger regularization is beneficial.

The output layer uses SoftMax activation with the number of neurons matching the number
of classes, producing a probability distribution across all possible classes.

I maintained the adaptive loss function selection from my previous implementations to

ensure flexibility across different classification scenarios. This automatically determines
whether to use categorical cross-entropy (for multi-class problems) or binary cross-entropy
(for binary classification) based on the output shape.

67
The Adam optimizer provides adaptive learning rates that work well across a wide range of
problems without requiring extensive hyperparameter tuning.

This CNN-based architecture represents a significant evolution in my approach to network

traffic classification. By leveraging principles from computer vision, I've created a model that
can potentially discover spatial relationships in network data that traditional fully connected
networks might miss, potentially improving classification performance on complex attack
patterns.

ANN
When developing this baseline model architecture, I opted for a straightforward yet
effective dense neural network design that balances complexity, performance, and
training efficiency. Here's how I approached building this model and the reasoning behind
each component:

Figure 55 Model creation ANN

I designed the network with a progressive narrowing structure (128 → 64 → output_classes),

which is a deliberate architectural choice. Starting with 128 neurons provides sufficient
capacity to capture the complex patterns in network traffic data. The second hidden layer
with 64 neurons creates a bottleneck that forces the network to learn more compact and
generalized representations before classification.

For both hidden layers, I selected ReLU (Rectified Linear Unit) activation functions because
they help mitigate the vanishing gradient problem while providing non-linearity. ReLU is also
computationally efficient, which speeds up training compared to other activation functions
like tanh or sigmoid.

Strategic Regularization

Figure 56 Strategic Regularization

I incorporated dropout regularization with a rate of 0.3 after the first dense layer. This was a
deliberate choice to prevent overfitting, which is particularly important when working with

68
network traffic data where the model might learn to recognize specific patterns too rigidly.
The 0.3 dropout rate represents a balance - high enough to effectively reduce overfitting but
low enough to preserve sufficient information flow through the network.

I specifically placed dropout after only the first layer rather than both layers because I found
through experimentation that this provided sufficient regularization without unnecessarily
constraining the network's capacity. This approach preserves more representational power in
the later stages of the network while still preventing overfitting.

Figure 57 ANN output layer

For the output layer, I used a Dense layer with softmax activation. The number of neurons
automatically adapts to match the number of classes in our classification problem
(represented by out_shape[1]). The softmax activation ensures the outputs sum to 1 and can
be interpreted as class probabilities, which is essential for classification tasks.

69
 The Experiment Orchestration Function

The heart of my framework is the experiment function, which ties everything together:

Figure 58 experiment function

I designed this function to accept key hyperparameters (optimizer, epochs, batch_size) as

arguments, making it easy to experiment with different configurations. The function
generates a unique model name using a timestamp, which ensures that each experiment's
results are stored separately and can be easily identified later.

For reproducibility, I set a fixed random seed:

This ensures that my experiments can be replicated with the same results, which is critical
for scientific validation.

For data preparation, I implemented several steps to ensure the data is properly
formatted for neural network training:

70
 Figure 59 Data preparation

I used a Label Encoder to convert text labels to numerical values, followed by one-hot
encoding with to_categorical() to prepare the target variable for neural network training.
Data normalization is applied to input features to ensure all variables are on a similar
scale, which helps with gradient descent convergence.
For splitting the data, I chose stratified sampling to maintain class distribution:

Figure 60 Stratified sampling

I specifically chose StratifiedShuffleSplit because network security datasets often have

imbalanced classes. This approach ensures that both training and testing datasets
maintain the original class distribution, preventing skewed evaluation metrics.

For the training process, I implemented Tensor Board monitoring and validation:

71
 Figure 61 Training

I included Tensor Board callbacks to visualize the training process and monitor metrics
over time. This provides valuable insights into model performance and helps identify
issues like overfitting early in the development process.
I implemented a comprehensive evaluation system that goes beyond simple accuracy
metrics

Figure 62 Metrics

I chose to include precision, recall, and F1 score because accuracy alone can be
misleading, especially with imbalanced classes common in network security data. The F1
score provides a harmonic means of precision and recall, giving a more balanced view of
model performance. I configured these metrics with the weighted average to account for
class imbalance.

72
 Figure 63 Framework usage

This design choice allows quick execution of experiments with different datasets without
modifying the code. I can simply run python Model_Training_DNN.py [Link] to start
an experiment with a new dataset, which streaDLines my workflow during research.

Figure 64 Feature extraction

I separated categorical and continuous features to facilitate feature engineering. This

comprehensive feature set covers various aspects of network flows, including packet
timing, sizes, flags, and protocol-specific information, providing the model with rich
information for classification.

Before starting the creation and training of the model, we have to configure the GPU to
be utilized for the training process in rare cases we will carry the training on the CPU
power but in this step we will follow tensorflow to use GPU.

73
 Setting GPU
First of all, I will open the official documentation of Tensorflow and we will follow step
by step.
[Link]

Figure 65 Setting GPU 1

According to the documentation I have to install Microsoft Visual C++ Redistributable for
Visual Studio 2015, 2017 and 2019

Figure 66 installing MV C++

74
 After installing Microsoft Visual C++ Redistributable for Visual Studio 2015, 2017 and
2019 I have to install a package and environment management software like Anaconda.
So I started by pulling anaconda installer using curl and output it to the downloads folder.

Figure 67 pull conda installer

Then I Installed mini-conda using the installer I pulled in the previous step.

Figure 68 install mini-conda

Then I followed the documentation to install python 3.9 and create a virtual environment.

75
 Figure 69 Virtual environment tf

Figure 70 VE tf

Then I Installed Cudatool kit and Cudnn.

Figure 71 Cudatool kit and Cudnn

76
Figure 72 Cudnn finished installing

Then I went to the official Tensorflow site to check for the latest GU version and Installed
Tensorflow gpu 2.10.0 because it is the latest GPU version.

Figure 73 latest Tensorflow gpu version

Figure 74 installing Tensorflow gpu

all the packages installed successfully.

Figure 75all packages installed

In this step I will verify GPU configured to be utilized.

77
 Figure 76 Verifying GPU

As we can see here now I can carry out the training and utilize the GPU instead of CPU.

Figure 77 GPU configured successfully

Usage and training process.

78
 Figure 78 Training Logs

Performance Evaluation and GPU Optimization

The training and testing logs capture comprehensive evaluation metrics, including
accuracy, recall, F1-score, and precision, to rigorously assess model performance.
To maximize computational efficiency, I configured the GPU for TensorFlow compatibility
and further enhanced its performance using Armor Crate software, switching it to
dedicated performance mode for optimized resource allocation during training.

Figure 79 Armor Crate

It shows me the statistics of the GPU while training.

In the testing part the results of the model training and evaluation will be shown

79
 Confusion Matrix
In this part I will walk through the implementation of the confusion matrix framework.

First, I needed to bring in the necessary libraries from Python's standard library and some
powerful external libraries.

Figure 80 CF-1

Basically, I brought in Numpy for the number crunching needed for the confusion matrix.
Matplotlib and Seaborn are there to draw the matrix visualization, with Seaborn making it
look good. Os helps me handle saving the output file, sys is for error handling, and argparse
lets people control the script easily from the command line.

The 'parse_stats_file' Function

The first core task was to read and understand the input stats file. I designed a function
specifically for this.

80
 Figure 81 CF-2

My goal with this function was just to read that file, go through it line by line, grab the
'name=count' entries, skip the extra stuff like totals or junk lines, make sure the count is
a number, and collect all the good pairs in order. And if the file is messed up, I want to
catch that too.
The 'main' Function and Script Execution

Figure 82 CF-3

I put the main steps of the script in a function called main(). Inside that, I use argparse to
ask the user for the necessary info right when they run the script from the command line:
where the stats file is, where to save the picture, and what the overall accuracy was.

81
 argparse grabs those values for me. The if __name__ == '__main__': part just makes sure
this main function runs automatically when someone executes the script.

Figure 83 CF-4

Here's where I actually put that parse_stats_file function to work. I call it to read the
input file the user specified. If that function comes back empty, meaning it couldn't find
any valid data, I know something's wrong with the file, so I print an error message and
just stop the script there. But if it successfully gives me the parsed data, I then pull out
the list of category names and the list of their counts separately. From those lists, I
quickly figure out how many different categories there are and the grand total of all the
counted items. And finally, I take the overall accuracy number the user gave me and
divide it by 100, so it's in that decimal format I need for later calculations.

Generating the Confusion Matrix Data

This was a key part. Since I didn't have actual prediction vs. actual labels from a model
run, I had to simulate a confusion matrix based on the overall accuracy and the
distribution of samples per class.

82
 Figure 84 CF-5

This section is where I actually build the confusion matrix data itself. I start by creating
an empty grid, filled with zeros, that's the right size for all my classes. Then, I go through
each class one by one. For each class, I figure out how many items were correctly
predicted for that class based on the overall accuracy I was given – those are the 'true
positives'. Whatever's left from that class's total count must be the errors. My strategy
here is to take those errors and spread them out among all the other classes in that row
of the matrix. I try to divide the errors as evenly as possible among the other classes, and
if there are any leftover errors, I just add one to the first few of those other classes until
they're all assigned. Finally, I place the row I just calculated, showing the true positives
and how the errors were distributed, into the main confusion matrix grid for that specific
class.
Preparing Statistical Information

83
 To make the visualization more informative, I decided to include key statistics as text
alongside the matrix.

Figure 85 CF-6

After I've got the data parsed and ready, I wanted to create a little summary that I could
include alongside the confusion matrix visualization. So, this bit is where I build a text
string called stats_info. I put in the overall model accuracy, the total number of samples
I processed, and then I list out each class and its count, just like I read it from the file. I'm
using f-strings to make it easy to pop those values directly into the text. This stats_info
string is basically a neat little package of the key numbers.
Visualizing the Results
This part focuses on using Matplotlib and Seaborn to create the actual plot.

Figure 86 CF-7

This is where I bring everything together visually! I set up a figure, which is basically the
canvas for my drawing. I decided to divide this canvas into a grid so I could place different
things in specific spots.
In the largest spot on the grid, I use Seaborn to draw the confusion matrix heatmap itself,
using the data I prepared earlier. I make sure the actual numbers are shown on the map,

84
give it a nice color scheme, and label the axes with the class names so you know what's
what. I also give this main plot a clear title and axis labels.
This is how to use it.

Figure 87 CF-frame work usage

This is the output

Figure 88 CF-output

85
 Evaluation Script
I built this Python script specifically to test the performance of the Intrusion Detection
System (IDS) models I train using Keras and TensorFlow. After training, I needed a
standard way to see how well they handle new, unseen data.

Figure 89 Mode Evaluation - Data preprocessing

First, I set it up to load a specific test dataset (a CSV file) and clean it by removing any
rows with missing info (load_test_data). Then, the crucial preprocess_data step ensures
this test data is formatted exactly like the training data was – normalizing the features
and numerically encoding the labels. This consistency is key for the model to understand
the input and for the evaluation to be fair.

86
 Figure 90 Model Evaluation - main part

The core of the script is evaluate_model. It takes the prepared data and the trained
model, calculates basic accuracy and loss, and then digs deeper. By comparing the
model's predictions to the actual labels, it computes important metrics like precision,
recall, and the F1-score, plus a detailed classification report. These metrics tell me not
just if the model is right, but how well it identifies different types of traffic (normal vs.
specific attacks), which is vital for an IDS.

87
 Figure 91 Model evaluation saving the results

Finally, to keep track of performance, the save_results function writes all these metrics
into a clearly labelled text file, named after the model and test set used. The main
function simply runs these steps sequentially – load model, load data, preprocess,
evaluate, print a summary, and save the report. I made it runnable from the command
line (if __name__ == "__main__":), so I can easily point it to different model files and test
datasets to evaluate them.

88
 Testing
Following the implementation of the Deep learning models and the supporting
framework, rigorous testing is essential to validate the system against its objectives,
evaluate its performance, and identify any potential issues. This section details the
comprehensive actions undertaken to ensure the effectiveness and efficiency of the
developed Anomaly-Based Intrusion Detection System (ANIDS) models. It outlines the
testing process, including the specific test cases derived from the evaluation scripts and
the metrics used to measure model performance and functionality. Furthermore, this
section will cover the results obtained from these evaluations, providing insights into the
models' capabilities in detecting network intrusions.

Test Plan
To ensure the developed Anomaly-Based Intrusion Detection System (ANIDS) framework
and models function correctly, perform efficiently, and meet the project objectives, a
systematic test plan was executed. The testing environment was crucial for verifying the
behavior and quality of the implemented solution before considering any potential
deployment scenarios. The following steps outline the testing process followed for this
project:
• Model Architecture Implementation Test: Verify that models based on each of the
four selected architectures (DNN, LSTM, CNN, ANN) can be successfully defined,
compiled, and initiated within the TensorFlow/Keras framework.
• Data Processing Pipeline Verification: Test the data cleaning and feature extraction
scripts to ensure they correctly process the raw CSE-CIC-IDS2018 dataset, handle
errors, and produce the intended binary and multi-class datasets suitable for
training.
• Training Environment Test: Execute model training processes on both CPU and GPU
configurations to confirm TensorFlow's ability to utilize the designated hardware
and compare performance differences.
• Model Performance Evaluation: Train each model architecture (DNN, LSTM, CNN,
ANN) on the prepared datasets and evaluate if the target accuracy of 96% or higher
can be achieved, meticulously recording metrics like precision, recall, and F1-score.

89
 • Hyperparameter Tuning Capability Test: Confirm that the framework allows for
hyperparameter tuning adjustments (e.g., learning rate, epochs, batch size) and
observe their impact on model performance.
• Confusion Matrix Generation Test: Verify that the dedicated script can generate and
save confusion matrix visualizations based on model evaluation results or simulated
accuracy inputs.
• Evaluation Script Functionality Test: Test the standalone evaluation script by using
it to assess the performance of different saved model files (.h5) against a designated
test dataset, ensuring it correctly loads models and calculates metrics.
• Chatbot Integration Test: Test the integrated Ollama chatbot within the data
cleaning script to ensure it initializes correctly and responds accurately to queries
about the cleaning process.
• Framework Adaptability Test: Assess the framework's ability to handle a completely
new (or different) dataset by attempting to load, preprocess, train, and evaluate a
model using it, confirming the system's flexibility.

Participants

While involving multiple participants in testing can offer diverse perspectives and
potentially uncover a wider range of issues, the testing for this project was conducted by
a single individual. This approach was adopted because the primary tester possesses a
comprehensive and relevant skill set spanning all critical domains of the project. This
ensured that all facets of the system, from data handling to model evaluation and
framework functionality, could be thoroughly assessed with the necessary expertise.
The sole tester for this system was Abbas Almutawa. His background and qualifications
are detailed below:

90
Name Age Gender Background
Abbas 21 Male Abbas is a fourth-year ICT Networking student with
Al- practical experience in network traffic analysis and
mutawa Deep learning implementations. His proficiency in
Python programming, particularly with
TensorFlow/Keras libraries, enables him to thoroughly
test the IDS model training pipeline, data
preprocessing functionality, and evaluation metrics.
His background in analyzing network traffic patterns
makes him ideal for assessing the system's ability to
accurately identify various attack types within network
datasets. His combined skills allow him to evaluate
both the technical implementation and practical
effectiveness of the intrusion detection models.
Table 4 Participants in testing

Functionality test case and results

The testing process for the Anomaly-Based Intrusion Detection System (ANIDS)
framework focused on verifying the system's ability to accurately define, train, and
evaluate Deep learning models for network traffic analysis. Each test scenario was
designed to validate specific components of the framework, from model architecture
implementation to data processing capabilities and overall performance metrics. The
participant, Abbas Almutawa, conducted these tests to ensure the system meets the
required functionality and performance standards before potential deployment.
The table below outlines the test scenarios, expected results, actual outcomes, and the
status of each test.

91
 No Test Scenarios Expected Result Actual Result Statu
. s
Deep learning Model Implementation & Training
1.1 DNN DNN model The model got pass
Architecture successfully created
Implementatio defined, successfully
n compiled, and using the
initiated within framework.
TensorFlow/Kera
s
1.2 LSTM LSTM model The model got pass
Architecture successfully created
Implementatio defined, successfully
n compiled, and using the
initiated within framework.
TensorFlow/Kera
s
1.3 CNN CNN model The model got pass
Architecture successfully created
Implementatio defined, successfully
n compiled, and using the
initiated within framework.
TensorFlow/Kera
s
1.4 ANN ANN model The model got pass
Architecture successfully created
Implementatio defined, successfully
n compiled, and using the
initiated within framework.
TensorFlow/Kera
s

92
 Data Processing & Feature Engineering
2.1 Data Cleaning Raw CSE-CIC- The framework pass
Script IDS2018 dataset cleaned the
Functionality successfully dataset as
cleaned with expected
missing values
handled and
outliers
addressed
2.2 Feature Features The framework pass
Extraction correctly extracted
Processing extracted from features as
cleaned dataset expected
for both binary
and multi-class
classification
2.3 Dataset Split Dataset properly The framework pass
Verification split into training, splits datasets
validation, and when provided
testing sets with for training
correct into training,
proportions validation, and
testing sets
Training Environment Configuration
3.1 CPU Training Models Tester is able to pass
Execution successfully train operate
on CPU training on
configuration CPU
with expected
resource
utilization

93
 3.2 GPU Training Models Tester is able to pass
Execution successfully train operate
on GPU training on
configuration CPU
with accelerated
performance
compared to CPU
3.3 Hardware Performance Comprehensiv pass
Utilization metrics show e results from
Comparison expected both training
difference enables
between CPU visualizing to
and GPU show
configurations difference.
Model Performance Assessment
4.1 Minimum At least one of Three of the pass
Accuracy the implemented models where
Achievement models (DNN, able to achieve
LSTM, CNN, or 96% two of
ANN) achieves them where
the minimum able to achieve
target accuracy 99% on normal
of 96% datasets
4.2 DNN DNN model Achieved 96% pass
Performance achieves target accuracy in
Evaluation accuracy of 96% training and
or higher with evaluation.
acceptable
precision, recall,
and F1-score

94
 4.3 LSTM LSTM model Achieved 96% pass
Performance achieves target accuracy in
Evaluation accuracy of 96% training and
or higher with evaluation on
acceptable normal dataset
precision, recall, not multi class
and F1-score and binary.
4.4 ANN ANN model Achieved 96% pass
Performance achieves target accuracy in
Evaluation accuracy of 96% training and
or higher with evaluation on
acceptable normal dataset
precision, recall, not multi class
and F1-score and binary.
Model Optimization & Visualization
5.1 Learning Rate Framework Framework pass
Adjustment allows allows
modification of parameters
learning rate modification to
with observable optimize
impact on model learning rate
performance
5.2 Epoch Count Framework Epoch can be pass
Modification allows changed
adjustment of
training epochs
with expected
impact on model
convergence
5.3 Batch Size Framework Batch Size can pass
Configuration allows be changed

95
 modification of
batch size with
observable
impact on
training speed
and model
performance
5.4 Confusion Script Script pass
Matrix successfully successfully
Generation generates and generates and
saves confusion saves
matrix confusion
visualizations for matrix
all model
architectures
Evaluation & Integration
6.1 Model Loading Evaluation script .h5 models are pass
Functionality correctly loads loaded
saved model files correctly
(.h5) for
performance
assessment
6.2 Metrics Evaluation script Framework pass
Calculation accurately displays
Verification calculates performance
precision, recall, metrics as
F1-score, and expected
other key metrics
6.3 Ollama Chatbot Chatbot Chatbot pass
Integration successfully answers all the
initializes within

96
 the data cleaning questions as
script and expected
responds
accurately to
queries
6.4 New Dataset Framework The framework pass
Adaptability successfully deals very well
processes a new with the new
network traffic dataset
dataset, trains
models, and
produces
evaluation
metrics
Table 5 Test scenarios table

Acceptance Tests Process & Results

This section of the testing plan involves participant acceptance of the overall intrusion
detection system framework. This testing provides perspectives of the participant and
determines if a certain procedure has failed or passed. The following table contains the
process and the result of acceptance testing.

97
 No. Participant process results
1 Abbas Attempted to All models were successfully
Almutawa define and train defined and compiled. DNN
all four model achieved the target accuracy of
architectures 96% or higher, with DNN
(DNN, LSTM, reaching 99% accuracy on
CNN, ANN) normal datasets.
using the
framework.
2 Abbas Tested data The framework successfully
Almutawa processing cleaned the dataset, handled
pipeline by missing values, addressed
providing raw outliers, and extracted relevant
CSE-CIC- features for both binary and
IDS2018 dataset multi-class classification tasks.
for cleaning and The dataset was properly split
feature into training, validation, and
extraction. testing sets with the correct
proportions.
3 Abbas Evaluated model All models trained successfully
Almutawa performance by on both hardware
training on both configurations. The framework
CPU and GPU provided comprehensive
configurations results showing expected
and comparing performance differences
results. between CPU and GPU
training environments,
allowing for proper
visualization of hardware
utilization metrics.
4 Abbas Tested model The framework successfully
Almutawa optimization allowed modification of all
capabilities by hyperparameters with

98
 adjusting observable impacts on model
hyperparameters performance. Confusion
including matrix visualizations were
learning rate, properly generated and saved
epoch count, and for all model architectures,
batch size. providing clear performance
insights.
5 Abbas Tested integration The framework correctly
Almutawa features including loaded saved model files (.h5)
model loading, for performance assessment,
metrics accurately calculated
calculation, precision, recall, F1-score, and
chatbot other metrics. The Ollama
functionality, and chatbot successfully initialized
new dataset and responded accurately to
adaptability. queries about the data cleaning
process. When provided with a
new network traffic dataset, the
framework successfully
processed it, trained models,
and produced evaluation
metrics.
Table 6 Test acceptance table

99
 Usability testing results and statistics
The goal of the usability testing and statistics part is to ensure the product is performing
as expected and, free of any issues or bugs, the feedback will be from the participant
testing the Framework. The testing includes Model creation for all model architectures,
training on CPU and GPU, producing confusion matrix, and evaluation of models after
training.

❖ DNN
In this part results of training DNN model will be displayed followed by confusion matrix
and model evaluation.
Dataset Accuracy (%) Precision (%) F1-score (%) Recall (%)
02-14-2018 97.40 97.64 97.39 97.40
02-15-2018 98.59 98.67 98.63 98.59
02-16-2018 99.71 99.71 99.71 99.71
02-22-2018 99.97 99.96 99.96 99.97
02-23-2018 99.95 99.91 99.93 99.95
03-02-2018 93.5 94.74 93.7 93.5
Binary-class 96.24 96.20 96.19 96.24
Multi-class 96.15 94.99 95.35 96.15
Table 7 DNN Metrics table

As a tester of the intrusion detection framework, my evaluation of the DNN model's

performance across multiple datasets reveals several important insights:

100
❖ DNN confusion matrix

Binary class confusion matrix

Figure 92 Binary class confusion matrix

101
 Multi class confusion matrix

Figure 93 Multi class confusion matrix

102
❖ DNN Model Evaluation
This section presents a comparative analysis of the DNN model's performance on binary
and multi-class taken from the framework after running the Model evaluation.
Model evaluation for Binary class

Figure 94 DNN evaluation for Binary class

Model evaluation for Multi class

Figure 95 DNN evaluation for Multi class

103
❖ RNN (LSTM)
In this part results of training LSTM model will be displayed followed by confusion matrix
and model evaluation.
Dataset Accuracy (%) Precision (%) F1-score (%) Recall (%)
02-14-2018 97.75 97.90 97.76 97.75
02-15-2018 97.48 97.36 97.14 97.48
02-16-2018 99.19 99.19 99.19 99.19
02-22-2018 99.97 99.96 99.96 99.97
02-23-2018 99.95 99.89 99.92 99.95
03-02-2018 95.16 95.88 95.27 95.16
Binary-class 90.12 89.97 89.72 90.12
Multi-class 91.79 91.11 90.84 91.79
Table 8 LSTM Metrics table

Reflecting on the LSTM model's performance, it shows strong capabilities on several

specific datasets from February 2018, frequently achieving accuracy above 97% and even
exceeding 99% on dates like 02-16, 02-22, and 02-23. This indicates the model effectively
learns patterns within stable, defined time periods. On 03-02-2018 (95.16% accuracy),
this episode highlights a critical sensitivity to temporal changes.
When evaluated on broader classification tasks, the LSTM's performance is more
moderate. For binary classification (attack vs. normal), yielded results (around 90%
accuracy). Conversely, for the more complex multi-class task of identifying specific attack
types of performance was superior (around 92% accuracy).

104
❖ LSTM confusion matrix
Binary class Confusion Matrix

Figure 96 Binary class Confusion Matrix

105
 Multi class Confusion Matrix

Figure 97 Multi class Confusion Matrix

106
❖ LSTM Model Evaluation
This section presents a comparative analysis of the LSTM model's performance on binary
and multi-class taken from the framework after running the Model evaluation.
Model evaluation for Multi class

Figure 98 LSTM evaluation for Multi class

107
 Model evaluation for Binary class

Figure 99 LSTM evaluation for Binary class

According to the test results, participants experienced no issues with the model creation
and evaluation processes. The DNN model demonstrated exceptional performance on
most CSE-CIDS-2018-aws datasets, consistently achieving accuracy above 97% with
particularly impressive results on 02-16, 02-22, and 02-23 datasets (all exceeding 99.7%).
Confirming that the attack detection capabilities were successfully implemented.
Furthermore, the binary and multi-class classification tests showed strong results (table
6 & 7), demonstrating the framework's effectiveness in categorizing specific attack types.
The data cleaning process performed exceptionally well, handling missing values and
outliers without errors (figure 34). The integrated Ollama chatbot functioned as expected
(figure 37), enhancing the user experience of the framework. When testing with
completely new datasets (figure 116 & 117 & 103 & 104), the system demonstrated
remarkable adaptability, confirming its robustness for real-world deployment. The
framework showed particular strengths with certain datasets.

108
❖ Finally, comparison of the best three Model Architectures used for Deep
learning
Architecture DNN
Metrics Accuracy Precision F1-score Recall
Multi-class 96.15 94.99 95.35 96.15
Binary-class 96.24 96.2 96.19 96.24
Table 9 Final Comparison DNN

Architecture LSTM
Metrics Accuracy Precision F1-score Recall
Multi-class 90.12 89.97 89.72 90.12
Binary-class 91.79 91.11 90.84 91.79
Table 9 Final Comparison LSTM

Architecture ANN
Metrics Accuracy Precision F1-score Recall
Multi-class 89.67 85.33 87.81 89.67
Binary-class 88.43 90.9 89.03 88.43
Table 10 Final Comparison ANN

❖ Final Comparison Bar graph

Deep learning techniques comparison

96.24
98
96.15 96.2 96.24
96.19 96.15
96 94.99 95.35

94
91.79 91.79
92 91.11 90.84 90.9
90.12 89.97 89.72 90.12 89.67 89.67
90 89.03
88.43 88.43
87.81
88
86 85.33

84
82
80
78
Accuracy Precision F1-score Recall Accuracy Precision F1-score Recall Accuracy Precision F1-score Recall
DNN LSTM ANN

Multi-class Binary-class

Figure 100 Deep learning Bar graph

109
 Discussion, LESPI, and Conclusion
This part of the paper outlined the features and reached the objectives as the final
solution. Moreover, reflecting on the lessons learned and problems encountered during
the project’s lifecycle development is important. This section will point out the aspects
that could be enhanced. Also, this section will reflect on the issues related to the work
that concerning the Kingdom of Bahrain.

System functionality
The final solution has successfully met all the core objectives of this project. It focuses on
detecting network intrusions by training an anomaly-based intrusion detection system
(ANIDS) using Deep learning models. The system analyzes network traffic and accurately
identifies anomalies, including previously unseen attacks. Implemented using Python and
TensorFlow, it supports both binary and multi-class classification. The model was trained
and evaluated on real-world datasets and achieved high accuracy, fulfilling the project’s
success criteria. The implementation strictly followed the design outlined in the
methodology, ensuring alignment with project goals.

Summary of Achieved Objectives

The final solution has achieved all key objectives and addresses limitations in traditional
signature-based systems. By replacing manual threat detection with an automated,
intelligent anomaly-based system, this solution improves threat identification especially
for novel attacks while enhancing adaptability and reducing human workload. The system
leverages multiple deep learning architectures (ANN, CNN, DNN, LSTM) to analyze
network traffic, supporting both binary and multi-class classification. Developed using
Python and TensorFlow, it was trained on real-world datasets and evaluated using
standard performance metrics.

110
No. Objective Status Description
1 Implement Multiple Achieved Successfully implemented DNN,
DL Architectures LSTM, CNN, and ANN models using
TensorFlow/Keras to detect anomalies
in network traffic.
2 Clean and Achieved Designed a script to clean the CSE-CIC-
Preprocess Data IDS2018 dataset, handle missing
values, outliers, and prepare the
dataset for training.
3 Feature Extraction Achieved Extracted relevant features for binary
and Dataset and multi-class classification; split
Splitting datasets into training, validation, and
testing sets.
4 Train Models Using Achieved Ensured models could train on both
CPU and GPU CPU and GPU configurations with
expected resource usage and
performance differences.
5 Achieve 96%+ Achieved Achieved ≥96% accuracy in DNN,
Accuracy LSTM, and ANN models; some
reached 99%. CNN failed due to
architecture not being suited for
tabular data.
6 Evaluate Model Achieved Accurately calculated precision, recall,
Performance F1-score, and other metrics to
evaluate the effectiveness of each
model.
7 Tune Achieved Allowed learning rate, batch size, and
Hyperparameters epoch count modification to improve
model performance.

111
8 Visualize Achieved Confusion matrices were successfully
Performance generated and saved to evaluate
(Confusion Matrix) classification accuracy visually.
9 Model Loading and Achieved Developed functionality to load
Evaluation trained .h5 models and evaluate them
Automation using prewritten scripts.
10 Chatbot Integration Achieved Integrated Ollama chatbot into
in Data Cleaning preprocessing script to assist with
automated Q&A during data
preparation.
11 Adaptability to New Achieved The framework was tested with new
Datasets network traffic datasets and
successfully trained and evaluated
models.
Table 10 Summary of Achieved Objectives

To conclude, project implementation has achieved all the objectives that were
documented in the project plan.

112
 Project issues
The implementation phase marks itself as the most critical aspect in the project, However,
in this phase numerous challenges where phased and directed the flow of the project
into a certain direction or even obstacles leading to restrictions in the approach followed.
This section will discuss the issues and limitation as well as propose the solutions that
will resolve the problem.
No. Challenge Solution
1 Finding dataset During implementation, I faced a critical challenge
that is up to date finding up-to-date, real network traffic datasets for
and based on real realistic anomaly detection. I struggled with several
network traffic to datasets like KDDCUP'99 and NSL-KDD, which
perform realistic contained excessive noise and outdated attack
anomaly detection. patterns making them difficult to process. After
extensive research, I finally discovered the CSE-CIDS-
2018-aws dataset from the University of New
Brunswick, which provided contemporary attack
vectors and realistic network traffic patterns essential
for validating the DNN model's capabilities against
modern cyber threats.
2 Cleaning large At first, I tried to take a sample and understand the
datasets and structure of the dataset by writing a script to clean it,
preparing them for but I failed to clean it in the proper form using my
the training knowledge in data analysis. Then my advisor
process. recommended following the approach in the research
paper I selected with my advisor at the beginning of
the project, so I studied how it was done and
replicated it using python to yield a clean polished
dataset even though the process of combining the
datasets was from the research paper.

113
3 Configuring GPU to While I was trying to set the GPU to be utilized
be used in the following the documentation on TensorFlow site
training process. wasn’t enough I followed all the instructions but still
the framework can’t detect the GPU. Moreover, I had
to refer to a YouTube video and Online forum and
taking a little of both with little changes of mine I was
able to configure the framework to detect GPU.
4 Finding the optimal In this part after being able to use GPU and CPU for
parameters to run training I experimented so much to find the best
Model training on. parameters in order to finish model training in a
decent time while still getting high accuracy. This
consumed a lot of time and experimenting with both
GPU and CPU but at the end I found the optimal
parameters because I never stopped experimenting.
5 Producing In the research that I followed there where confusion
confusion matrix matrix to represent model accuracy and show what
did the model identified wrong and write there were
no ready tools that do this, so I had to study how it is
made and write a python script that does the job.
With a bit of experimenting, I understood the logic
behind it and developed my own tool to do it.
Table 11 Project issues table

Backup plan
All the scripts behind the framework and models are stored in a GitHub repository making
it available and accessible at anytime also I have configured the training environment on
two devices in case one of the devices failed or we don’t have access to it anymore. I have
documented steps to configure a new device to be able to carry out the training process
so the project is backed up well and available in all times.

114
 Future work
In this section of the paper approaches to further enhance the product and make it more
reliable to fit the industry standards will be discussed.

Real-time Network Traffic Analysis Integration - Implement stream processing

capabilities to analyze live network traffic rather than historical datasets. This would
transform your solution from a retrospective analysis tool to a proactive security
monitoring system capable of detecting threats as they emerge.

Explainable AI Components - Develop visualization tools that explain why specific

network packets were flagged as anomalies. This transparency would enhance trust in
the system and provide security analysts with actionable insights for faster incident
response.

Federated Learning Implementation - Enable distributed model training across multiple

network endpoints without centralizing sensitive data. This would allow organizations to
benefit from collective intelligence while maintaining data privacy and reducing
bandwidth requirements.

Adversarial Defense Mechanisms - Incorporate techniques to make your models

resistant to adversarial attacks that deliberately attempt to fool Deep learning systems.
This addition would close a critical security gap as sophisticated attackers increasingly
target AI-based detection systems themselves.

Synopsis of my experience
My experience with this project was one of a kind because in this project I did something
for the first time in my life, but I knew I had the knowledge and skills to build it. I
demonstrated all what I’ve learned in the past four years in this project and seeing it work
enhances my confidence in my skills and proves to me who I am. There was a long period
of uncertainty and questioning but I kept going and learning and step by step the image
became clear.

115
Deep learning is very interesting and applying it to a field the I like which is networking and
security is even more interesting. The world is shifting toward ai driven solution and being
able to implement my project in a short period makes me believe that I could contribute to
a project on a wider scale in the future. This is one of the projects that I will not forget and
be proud that I’ve built it by myself.
I would like to express my sincere gratitude to my supervisor, Mr. Saeed Al-Samhi, for his
invaluable guidance, patience, and expertise throughout this journey. His insightful
feedback and unwavering support helped me navigate through challenging obstacles and
refine my implementation approach. I am equally grateful to Mr. Cyril Anthony, the project
manager, whose strategic direction and technical advice were instrumental in shaping this
project. Their mentorship not only contributed significantly to the successful completion of
this project but also enriched my learning experience and professional growth.

Bahraini Perspectives
From a Bahraini perspective, this project represents an important contribution to the
kingdom's cybersecurity landscape. As Bahrain continues its digital transformation journey
through initiatives like the Economic Vision 2030, robust network security systems have
become increasingly critical for protecting national digital infrastructure.
The implementation of advanced deep learning models for anomaly detection aligns
perfectly with Bahrain's growing focus on artificial intelligence and cybersecurity
capabilities. This project demonstrates how local talent can develop sophisticated AI-driven
security solutions that address global challenges while being tailored to regional needs.
The successful implementation of this framework could benefit various sectors in Bahrain,
from telecommunications and financial services to government entities that face evolving
cyber threats. By utilizing modern datasets and achieving high accuracy rates, this solution
offers a practical approach that Bahraini organizations can adopt to enhance their security
posture.
Furthermore, this project supports Bahrain's ambitions to become a regional hub for
technological innovation, showcasing the caliber of technical expertise being developed
within the kingdom's educational institutions.

116
 Conclusion
This project successfully demonstrates the application of deep learning architectures for
network anomaly detection, achieving the primary goal of creating a robust framework
capable of identifying cyber threats with high accuracy. The implementation of multiple
models, particularly the DNN architecture, proved highly effective across various CSE-CIDS-
2018-aws datasets, consistently delivering accuracy rates above 97%.
The research highlights the importance of clean, representative datasets in cybersecurity
applications. Overcoming the challenge of finding suitable contemporary datasets was a
significant achievement that contributed to the project's success. The integration of an
Ollama chatbot into the data cleaning process represents an innovative approach to making
complex DL systems more accessible and user-friendly.
Several promising research directions emerge from this work. Implementing real-time
traffic analysis capabilities would transform this solution from analytical to preventative.
Additionally, incorporating explainable AI components would enhance trust and provide
actionable insights for security personnel. Federated learning approaches could address
data privacy concerns while maintaining detection capabilities across distributed networks.
The project's adaptability to new datasets demonstrates its potential for practical
implementation in real-world environments. This flexibility is particularly valuable in the
rapidly evolving cybersecurity landscape where threat actors continuously modify their
techniques. The successful integration of deep learning with network security validates the
approach as a viable alternative to traditional signature-based detection methods.
These findings contribute to the growing body of knowledge on AI-driven security solutions,
offering a practical framework that organizations can adapt to strengthen their
cybersecurity posture against modern threats. As cyber attacks continue to evolve in
sophistication, such intelligent detection systems will become increasingly essential
components of comprehensive security strategies.

117
 Reference list
I. Axelsson, S. (2000). Intrusion detection systems: A survey and taxonomy.
Department of Computer Engineering, Chalmers University of Technology.
II. Chandola, V., Banerjee, A., & Kumar, V. (2009). Anomaly detection: A survey. ACM
Computing Surveys, 41(3), Article 15. [Link]
III. Javaid, A., Niyaz, Q., Sun, W., & Alam, M. (2016). A deep learning approach for
network intrusion detection system. EAI Endorsed Transactions on Security and
Safety, 16(9), e2. [Link]
IV. Scarfone, K., & Mell, P. (2007). Guide to intrusion detection and prevention
systems (IDPS) (NIST Special Publication 800-94). National Institute of Standards
and Technology. [Link]
V. Talukder, M. A., Islam, M. M., Uddin, M. A., Hasan, K. F., Sharmin, S., Alyami, S. A.,
& Moni, M. A. (2024). Deep learning-based network intrusion detection for big
and imbalanced data using oversampling, stacking feature embedding and feature
extraction. Journal of Big Data, 11(1), 33.
[Link]
z (Note: Added DOI based on journal information)
VI. Vinayakumar, R., Alazab, M., Soman, K. P., Poornachandran, P., Al-Nemrat, A., &
Venkatraman, S. (2019). Deep learning approach for intelligent intrusion
detection system. IEEE Access, 7, 41525–41550.
[Link]
VII. Abadi, M., Barham, P., Chen, J., et al. (2016). TensorFlow: A system for large-scale
Deep learning. 12th USENIX Symposium on Operating Systems Design and
Implementation (OSDI 16), 265–283.
VIII. Pedregosa, F., Varoquaux, G., Gramfort, A., et al. (2011). Scikit-learn: Deep learning
in Python. Journal of Deep learning Research, 12, 2825–2830.
IX. McKinney, W. (2010). Data structures for statistical computing in Python.
Proceedings of the 9th Python in Science Conference, 51–56.
X. Krizhevsky, A., Sutskever, I., & Hinton, G. E. (2012). ImageNet classification with deep
convolutional neural networks. Advances in Neural Information Processing Systems,
25.
XI. Goodfellow, I., Bengio, Y., & Courville, A. (2016). Deep learning. MIT Press.
XII. Hochreiter, S., & Schmidhuber, J. (1997). Long short-term memory. Neural
Computation, 9(8), 1735–1780. [Link]

118
 XIII. Garcı ́a-Teodoro, P., Díaz-Verdejo, J., Maciá-Fernández, G., & Vázquez, E. (2009).
Anomaly-based network intrusion detection: Techniques, systems and challenges.
Computers & Security, 28(1–2), 18–28. [Link]
XIV. Sommer, R., & Paxson, V. (2010). Outside the closed world: On using Deep learning
for network intrusion detection. 2010 IEEE Symposium on Security and Privacy, 305–
316. [Link]
XV. Moustafa, N., & Slay, J. (2015). UNSW-NB15: A comprehensive data set for network
intrusion detection systems (UNSW-NB15 network data set). 2015 Military
Communications and Information Systems Conference (MilCIS), 1–6.
[Link]

119
 Appendix I: Administrator and User Manuals
User Manual
This section will contain user manuals for three phases of the command-line
orchestration framework the first phase will be the Data cleaning and polishing, the
second phase will be Model building and training, and finally the Model evaluation phase.

First and foremost, start Cortex Guard.

Figure 101 System and User Manuals starting tool

❖ Data cleaning and polishing

Six options will be displayed in this phase we will deal with the first three to guide you on
how to use them.
[1] Clean Data
[2] Combine Data
[3] Clean Data (Version 2 - Epoch Check)
As they are ordered.

120
❖ Clean Data
Choose 1 from the list.

Figure 102 System and User Manuals clean all files

Then you will be prompted to clean all files (recommended if you have multiple files
instead of entering each file manually). The second option is entering a specific file
(recommended if you have only one file) in our case we have multiple, so we went for all.
While the tool operates it will display logs to inform you about the progress.

Figure 103 System and User Manuals cleaning logs

After the first cleaning process is done the chatbot prompt will appear and you will be
able to ask the bot about the cleaning process.

121
 Figure 104 System and User Manuals chatbot thinking

As we can see in the figure above after entering the prompt to the bot the bot starts
thinking and answers the question.

Figure 105 System and User Manuals chatbot answer

Now we have finished the initial cleaning we can return to the main menu by pressing
enter.

122
 Figure 106 exiting clean data

Now we will see how to use it for a single file.

Figure 107 using specific data clean

It does the same job but you will have to enter each file manually as shown in the figure
above.

Figure 108 cleaning single file

123
❖ Combining datasets
In this part we will combine all the data sets we have into one file with all the attacks and
from that file we will create another copy with binary values 0 for benign and 1 for
attacks.
Using it is simple.

Figure 109 using Combining

Just choose it and it will combine all the present datasets.

Figure 110 logs for combining

The output of the combining will be 4 files 2 multiclass and 2 binaryclass.

124
 Figure 111 combined output

Now we will return to the main menu by pressing enter.

❖ Clean v2
This is the final part of the first phase to clean the binary and multi class files.

Figure 112 clean binary class

Choose 3 from the main menu then choose specific then enter the binary or multi file
then the base name and finally the name of the directory that will contain the clean files.

Figure 113 cleaning logs

125
 Figure 114 output of cleaning binary class

Now we will clean the multiclass.

Figure 115 cleaning multiclass

Figure 116 cleaning logs

Multiclass output.

126
 Figure 117 Multiclass output

❖ Model building and training phase

From the main menu choose option 4.

Figure 118 Building an IDS Model

Then you will be asked about the architecture that you want to build the model on, then
you will be asked to provide a dataset to train the model on.

127
 Figure 119 Model training

After completing the training process several metrics are displayed informing us about
the performance of the model finally the model is saved so we could evaluate it.
Model building and training for LSTM.

Figure 120 Model training LSTM

128
 Figure 121 Lstm model training

Figure 122 Metrics of LSTM training

❖ Model Evaluation
This is the final phase where we evaluate the model that we have built and trained.
First we will evaluate the model using the sixth option on the list.

To test the model, we will first choose the architecture as each model differs and
evaluating each model architecture is different to avoid incompatibility errors. Choose
the correct architecture DNN for DNN models and LSTM for LSTM models. And input the
data you want to test on.

129
 Figure 123 Model Evaluation DNN

As we can see the stats of Evaluating the model is displayed in the form of Accuracy, Loss,
Precision, Recall, and F1-score.
Also, the numbers refer to the types of attacks and corresponding metrics.
LSTM

130
 Figure 124 Model evaluation LSTM

Figure 125 LSTM Evaluation results

This is the last part of the third phase.

Choose the confusion Matrix from the Main menu.

Enter the stats file name of the output file and the accuracy you got after evaluating the
model.

131
 DNN confusion matrix

Figure 126 DNN confusion matrix

LSTM confusion matrix

Figure 127 LSTM confusion matrix

At this point that is all for the user manual I’ve covered all the functionalities of Cortex
Guard.

132
 Administrator manual
As an administrator you can modify the following parameters to optimize model training
based on your environment.

Figure 128 Admin manual

133
 Appendix II: Detailed Design

Figure 129 Activity diagram for Data cleaning

134
 This activity diagram outlines a typical user-driven workflow for a command-line data-
cleaning utility. It begins with the user launching the tool and choosing among available
actions (e.g. single-file cleaning, directory-wide processing, or an advanced “v2” mode).
The system then executes a defined sequence of cleaning operations, after which control
returns to the main menu. From there, the user may combine datasets or re-invoke
another cleaning routine. Finally, once all requested tasks including optional report or
statistics generation are complete, the process terminates.

❖ Model building and training phase

In this part we will have a visual representation of the machine-learning pipeline diagram
and a sequence diagram to depict the design of this phase.

Figure 130 machine-learning pipeline diagram

This "Model building and training" phase of the Cortex Guard system involves three key
activities: first, IDS Model Building, where the intrusion detection model's architecture
is designed and constructed (symbolized by a brain and hammer). Second, IDS Model
Training, where the built model is fed data to learn patterns and identify potential
security threats (represented by a brain with a gear and wrench). Finally, IDS Model
testing involves preliminary evaluations and refinements of the model during its
development to ensure it's learning effectively (depicted by a brain and clipboard),
preparing it for Cortex Guard's subsequent final evaluation phase.

135
❖ Sequence diagram

Figure 131 Phase 2 sequence diagram

This sequence diagram illustrates the user's interaction with the Cortex Guard system to
train an intrusion detection model. The user selects a model architecture (DNN or LSTM)
and a dataset, then Cortex Guard coordinates the building, training, and testing of the
IDS model, ultimately returning the trained model to the user.

136
❖ Model Evaluation

Figure 132 Model Evaluation

This sequence diagram shows a user interacting with "Cortex Guard" to evaluate a Deep
learning model. The user provides prompts for the model type, dataset, and architecture
(DNN or LSTM), and Cortex Guard then prepares the data, runs tests, and returns
performance metrics like precision, recall, F1-score, and accuracy.

137
 Appendix III: Detailed Implementation
❖ Initial Cleaning Script

Figure 133 Detailed Implementation cleaning Script 1

Figure 134 Detailed Implementation cleaning Script 2

138
 Figure 135 Detailed Implementation cleaning Script 3

Figure 136 Detailed Implementation cleaning Script 4

139
 Figure 137 Detailed Implementation cleaning Script 5

❖ Combining Script

Figure 138 Detailed Implementation Combining script 1

140
 Figure 139 Detailed Implementation Combining script 2

❖ Cleaning v2

Figure 140 Detailed Implementation cleaningv2 Script 1

141
 Figure 141 Detailed Implementation cleaningv2 Script 2

❖ Model Training DNN

Figure 142 Detailed Implementation DNN model training Script 1

142
 Figure 143 Detailed Implementation DNN model training Script 2

Figure 144 Detailed Implementation DNN model training Script 3

143
 Figure 145 Detailed Implementation DNN model training Script 4

Figure 146 Detailed Implementation DNN model training Script 5

144
❖ Model Training LSTM

Figure 147 Detailed Implementation LSTM model training Script 1

Figure 148 Detailed Implementation LSTM model training Script 2

145
 Figure 149 Detailed Implementation LSTM model training Script 3

Figure 150 Detailed Implementation LSTM model training Script 4

146
 Figure 151 Detailed Implementation LSTM model training Script 5

Figure 152 Detailed Implementation LSTM model training Script 6

147
❖ Model Evaluation

Figure 153 Detailed Implementation Model evaluation 1

Figure 154 Detailed Implementation Model evaluation 2

148
 Figure 155 Detailed Implementation Model evaluation 3

❖ Confusion Matrix

Figure 156 Detailed Implementation confusion matrix 1

149
 Figure 157 Detailed Implementation confusion matrix 2

Figure 158 Detailed Implementation confusion matrix 3

150
❖ Cortex Guard

Figure 159 Detailed Implementation Cortex Guard 1

Figure 160 Detailed Implementation Cortex Guard 2

151
 Figure 161 Detailed Implementation Cortex Guard 3

Figure 162 Detailed Implementation Cortex Guard 4

152
 Figure 163 Detailed Implementation Cortex Guard 5

Figure 164 Detailed Implementation Cortex Guard 6

153