Franklin Open 12 (2025) 100339

Contents lists available at ScienceDirect

Franklin Open
journal homepage: [Link]/locate/fraope

Data-driven network intrusion detection using optimized machine

learning algorithms
Dauda Adeite Adenusi a , Oladosu Oyebisi Oladimeji b,* , Theopilus Adekunle Oyekola a ,
Korede Solomon Olagunju a
a
Department of Mathematical and Computing Sciences, KolaDaisi University, Ibadan, Nigeria
b
Faculty of Engineering and Design, Atlantic Technological University, Sligo F91 YW50, Ireland

A R T I C L E I N F O A B S T R A C T

Keywords: Network intrusion detection systems (NIDS) play a crucial role in maintaining cybersecurity by identifying
Intrusion detection system malicious network activities. This study presents a comprehensive evaluation of machine learning approaches for
Machine learning network intrusion detection, comparing the performance of Decision Trees (DT), Random Forest (RF), K-Nearest
Cyber security
Neighbors (K-NN), Gradient Boosting (GB), and Logistic Regression (LR) algorithms. The research investigates
Data preprocessing
the impact of data preprocessing techniques, including data balancing and duplicate removal, on detection
performance. Experimental results demonstrate exceptional performance of tree-based methods, with DT and RF
achieving accuracy rates of 0.9997 and 0.9996 respectively, alongside precision rates exceeding 0.99.
Comparative analysis with existing approaches, including deep learning methods, shows that our optimized tree-
based models achieve comparable or superior performance while maintaining computational efficiency. The
proposed approach demonstrates perfect Area Under the Curve (AUC) scores of 1.00 for tree-based methods,
indicating robust detection capabilities across varying decision thresholds. This research contributes to the field
by establishing that simpler machine learning models can achieve state-of-the-art performance in network
intrusion detection, offering practical implications for real-world deployment in network security operations.

1. Introduction NIDS are generally classified into two primary categories: signature-
based detection systems (also known as misuse detection) and anomaly-
The advances and extensive use of interconnectivity and interoper­ based detection systems [6]. Signature-based detection systems rely on
ability in information and communication technologies (ICT) have identifying predefined attack patterns, which are stored in a database of
become essential in transforming our day-to-day activities [1]. Simul­ known signatures, to detect intrusions in network traffic. As a result,
taneously, cyber-attacks on ICT systems are growing more sophisticated signature-based detection systems are effective at identifying attacks
and occurring frequently which is harmful to individuals, organisations with known signatures and patterns. However, these systems are
and societies [2]. Hence, information security in networks has become a vulnerable to new attacks because they cannot detect unfamiliar threats
critical necessity in modern society to safeguard private information that do not match previously observed patterns. Additionally, due to
confidentiality, integrity, and availability [3]. Therefore, network se­ excessive traffic and its dynamic behaviour, signature-based detection
curity utilizes tools such as firewalls, antivirus software, and intrusion systems are proving to be useless and inefficient. Furthermore,
detection systems (IDS) to safeguard the network and its assets in cy­ complexity and attacker behaviours differ; therefore, it is challenging to
berspace, ensuring protection against potential threats [4]. These model both normal and malicious activities by identifying correlations
Network Intrusion Detection Systems (NIDS) are dedicated tools that and summarizing patterns from vast amounts of network access
monitor network traffic, analyse data packets, and detect suspicious or behaviour [7].
unauthorized activities. They are essential in protecting networks from On the other hand, anomaly-based detection systems rely on iden­
evolving security threats [5]. tifying behaviours or patterns that deviate from established norms,

* Corresponding author at: Faculty of Engineering and Design, Department of Computing and Electronics, Atlantic Technological University, F91 YW50 Sligo,
Ireland.
E-mail addresses: [Link]@[Link] (D.A. Adenusi), [Link]@[Link] (O.O. Oladimeji), thooye7@[Link] (T.A. Oyekola),
olagunjukoredesolomon@[Link] (K.S. Olagunju).

[Link]
Received 27 October 2024; Received in revised form 17 January 2025; Accepted 4 August 2025
Available online 9 August 2025
2773-1863/© 2025 The Author(s). Published by Elsevier Inc. on behalf of The Franklin Institute. This is an open access article under the CC BY license
([Link]
D.A. Adenusi et al. Franklin Open 12 (2025) 100339

flagging such deviations as potential security threats. As a result, 2.1. Data description
anomaly-based detection systems can identify previously unknown at­
tacks or intrusions by relying on models that define and characterize The dataset used in this research is the CSE-CIC-IDS2017 dataset,
normal behaviour, making them more adaptable to emerging threats. developed by the Canadian Institute of Cybersecurity [14] (available at
However, achieving a high degree of accuracy in detecting anomalies, [Link] This open-source
while simultaneously reducing false positive rates, remains a significant dataset is notable for its comprehensive features within each data
challenge in the development and implementation of these systems [8]. sample and the diverse array of cyberattacks it represents [15]. It en­
As a result, research on intrusion detection systems has consistently compasses over 85 traffic features and 3,119,345 instances, making it a
been a critical focus in network security. With the availability of valuable resource for analysing and detecting a wide range of network
network traffic data in this era coupled with advanced techniques like intrusion behaviours. The dataset includes eight distinct attack sce­
Information Technology and data analysis; ML has gained prominence narios: brute-force attacks, Heartbleed vulnerabilities, botnet activities,
as a promising approach to intrusion detection research [9]. Machine Denial of Service (DoS), Distributed Denial of Service (DDoS),
learning-based Network Intrusion Detection Systems (ML-based NIDSs) web-based attacks, and internal network intrusions each stored as a
have demonstrated their capability to detect both known (prevalent) comma-separated value (CSV) file.
and zero-day attacks [10]. Hence, there is widespread incorporation of
machine learning models into NIDS [4]. Kurniabudi et al [11] analysed 2.2. Data preprocessing
and selected relevant features from the CICIDS-2017 dataset and used
machine learning algorithms to develop NIDS. Similarly, using the same The initial preprocessing step involves merging these data sources to
dataset, Priyanka and Kumar [12] assessed the performance of machine create a unified dataset as highlighted in Fig. 1. The merging was done
learning algorithms of which RF performed best. After using the RFE using the concatenation function of pandas library (concat()). An anal­
(Recursive feature elimination) technique to select the relevant features, ysis of the class distribution in the dataset showed that the dataset has a
Panwar et al [13] utilised eight machine-learning algorithms for IDS significantly higher proportion of benign instances than malicious ones,
development. indicating a bias toward non-malicious network traffic. Hence, the
However, the quality of the data set determines the reliability of the dataset was classified into two traffic categories: benign and attack by
model. Building machine learning models can be particularly chal­ combining the non-malicious classes. This combination was also done by
lenging when dealing with missing data, especially when both training previous works that used the same dataset such as [16–18].
and test datasets contain missing values [8]. This can lead to biased Duplicate instances can distort a model’s actual performance [19].
predictions, reduced model performance, and difficulties generalising To mitigate potential biases, the dataset was carefully refined by iden­
across different datasets. Additionally, constant values introduce tifying and removing duplicates and missing values, ensuring the
redundancy into the dataset, potentially increasing computational uniqueness of each instance using the drop duplicates(drop_duplicates())
overhead and making the model more complex without adding value. and (dropna()) functions from pandas.
Predictive models may suffer from overfitting on imbalanced training A key challenge in machine learning is the high dimensionality of
sets, leading to poor generalisation and underperformance on test sets or datasets [20], which requires substantial memory to process numerous
real-world applications. Hence, this study aims to develop a robust features and often results in overfitting. Hence, features with constant
model for NIDS based on the improved pre-processed dataset to ensure values were removed from the dataset as they do not contribute to
the generalizability and practicability of the model. Furthermore, inference or offer any valuable insights to the model. Additionally,
explaining the predictions of ML-based intrusion detection systems (IDS) generic features such as Flow ID, Source IP, Destination IP, and Time­
is crucial, as different types of users benefit from understanding the root stamp were excluded from the dataset, as they do not provide significant
cause of the detection. Consequently, this study aims to make the models value for the learning process.
explainable to promote explainable NIDS. Machine learning algorithms often rely on numerical stability and
may encounter difficulties when handling infinite values. Therefore,
2. Methodology instances with infinitely large values were removed from the dataset.
Finally, the target class was transformed from the categorical data into
This section presents details of the dataset and techniques used in numerical format using the scikit-learn label encoder function (Label­
data preprocessing, feature selection, data balancing and model devel­ Encoder()). After the preprocessing stages, the dataset entails 2,827,677
opment as shown in Fig. 1. instances and 73 features while the benign and intrusion classes entail
2,272,688 and 556,697 respectively. The class distribution is highly
skewed.

Fig. 1. The proposed approach for the network intrusion detection system model.

2
D.A. Adenusi et al. Franklin Open 12 (2025) 100339

2.3. Data splitting and balancing 3. Experimental results and discussion

The dataset was divided into training and testing using the (70:30) The system used for this study is equipped with Windows 11 (64-bit)
ratio; a similar ratio was used by [16–18]. As a result of the skewness of running on an Intel(R) Core (TM) i7-12850HX @ 2.10 GHz and the
the dataset, a novel approach called Dynamic Ensemble Undersampling analysis is conducted using Python 3 within the Jupyter Notebook
with Boosting (DEUB). This method combines the strengths of ensemble framework. The balanced training set was used to train the models based
learning, specifically AdaBoost, with dynamic undersampling tech­ on the algorithms and was evaluated using the test set. This section
niques to create a robust classifier for imbalanced data. Table 1 provides provides the results of the models’ performance. The evaluation of the
step-by-step details of how the DEUB algorithm operates. models was assessed using metrics such as accuracy, precision, recall
For this study, AdaBoost classifier was initialised using decision trees and F1-score. These are the standard metrics used in evaluating classi­
(with a maximum depth of 3) as base estimators. The number of esti­ fication models. The Accuracy measures the proportion of correctly
mators and learning rate are configurable parameters. For each iteration classified instances out of the total number of predictions. However, it
of the AdaBoost algorithm, random undersampling was performed on can be misleading in imbalanced datasets like this study, where the
the input data while automatically adjusting the class distribution. To majority class (e.g., normal traffic) dominates. Hence, other metrics
prevent excessive data reduction, a max_samples parameter was intro­ such as the F1 score which is the harmonic mean of precision and recall.
duced. This parameter, set as a fraction of the original dataset size, It balances the trade-off between false positives and false negatives. F1-
controls the maximum number of samples to retain after undersampling. score is useful in scenarios with imbalanced datasets, as it ensures that
If the undersampled dataset exceeds this limit, an additional random both the model’s ability to detect intrusions (recall) and the quality of
selection is performed to further reduce the dataset size. positive predictions (precision) are considered equally [21]. Precision
The AdaBoost ensemble is then trained on this dynamically balanced calculates the proportion of true positive predictions (e.g., actual in­
dataset. This process allows each weak learner in the ensemble to trusions) out of all positive predictions made by the model. It focuses on
potentially see a different balanced subset of the data, promoting di­ reducing false positives, which is important in intrusion detection to
versity in the ensemble. This approach aims to leverage the power of avoid wasting resources on benign traffic falsely flagged as an attack. On
ensemble methods while addressing the challenges of class imbalance. the other recall measures the proportion of true positive instances
By dynamically creating balanced subsets for each weak learner, DEUB correctly identified by the model out of all actual positive instances. It is
strives to maintain the diversity of the original dataset while mitigating particularly important in intrusion detection to ensure that most in­
the impact of the majority class. trusions are detected (i.e., minimizing false negatives), as undetected
attacks can have serious consequences.
2.4. Classification
Table 2
In this study, six different classification methods were implemented:
Performance details of the algorithms with and without balanced (BD) training
Decision Tree (DT), Random Forest (RF), K-Nearest Neighbour (KNN), set.
Gradient Boosting (GB) and Logistic Regression (LR). The algorithms
Algorithm Accuracy Precision Recall F1-Score
were selected based on their wide usage by existing works such as [13,
16]. Additionally, they represent a diverse range of machine learning DT imbalanced 0.9995 0.9978 0.9997 0.9987
balanced 0.9997 0.9991 0.9993 0.9992
paradigms, including tree-based methods (DT, RF), ensemble methods ​
RF imbalanced 0.9994 0.9973 0.9995 0.9984
(GB), distance-based approaches (KNN), and linear models (LR). The ​ balanced 0.9996 0.9991 0.9988 0.9989
goal is to explore a range of model architectures and approaches to K-NN imbalanced 0.9858 0.9371 0.9947 0.9650
identify the optimal classification performance, tailored to the specific ​ balanced 0.9913 0.9718 0.9845 0.9781
characteristics of the dataset. These algorithms were trained on the GB imbalanced 0.9942 0.9762 0.9950 0.9855
balanced 0.9969 0.9941 0.9903 0.9922
balanced training set and evaluated using the test set.
​
LR imbalanced 0.7795 0.4672 0.8483 0.6026
​ balanced 0.8798 0.7678 0.5590 0.6470

Table 1
The operation of DEUB algorithm.
Inputs
Training data: features (X) and labels (y)
T: Number of estimators
Alpha: Maximum sample fraction (0<alpha≤1)
Lambda: Learning rate
Output: Balanced dataset: X_balanced, y_balanced
1. Initialize:
Set sample weights w = [1/n, ..., 1/n] for n samples
X_balanced = [], y_balanced = []
2. For t= 1 to T:
Calculate current max samples: n_max= min(len(minority), int(max_samples*len(X))
Random sampling: X_t, y_t = RandomUnderSampler.fit_resample(X,y)
If len(X_t)>n_max:
Randomly select n_samples from X_t,y_t
Train a weaker learner (decision tree) h_t on X_t, y_t
Compute weighted error of h_t: error_t=sum(w[i] for I where h_t(X[i])!=y[i])/sum(w)
Compute weight of weak learner: alpha_t = 0.5*log((1-error_t)/error_t)
Update sample weights: For each sample i:w[i]=w[i]*exp(-alpha_t*y[i]*h_t(X[i]))
Normalize weights: w=w/sum(w)
Add unique samples from X_t, y_t to X_balanced, y_balanced
3. If len (X_balanced)>desired_balanced_size:
Select top desired_balanced_size samples based on final weights
4. Return X_balanced, y_balanced

3
D.A. Adenusi et al. Franklin Open 12 (2025) 100339

Table 2 provides the performance summary of the algorithms in computing environments. Table 3 provides a comparison between our
terms of accuracy, precision, recall and F1 score before and after data model and existing approaches.
preprocessing and data balancing respectively. Fig. 2. showcases the One key factor contributing to the improved performance of this
Receiver Operating Characteristic (ROC) curve, depicted in various study compared to previous ones was the rigorous data cleaning and
colours, representing the performance of different machine learning preprocessing steps undertaken, including the removal of duplicate and
algorithms. constant values, as well as the application of data balancing techniques.
Result of the ROC and Table 1 indicates that the intrusion detection While deep learning architecture like [17] shows promising results,
problem has inherently non-linear decision boundaries while the the tree-based methods achieved comparable or better performance
remaining algorithms that overlapped each other in Fig. 2 were able to without the computational overhead and complexity associated with
discriminate intrusion and benign traffic. deep neural networks. This suggests that simpler algorithmic ap­
The Receiver Operating Characteristic (ROC) curve shown in Fig. 2 proaches may be more practical and equally effective for this specific
displays the performance comparison of the five machine learning al­ task. Compared to [17] that used baseline RF, this study proves that an
gorithms. The ROC curve plots the True Positive Rate (sensitivity) improved model can be achieved with more effective preprocessing
against the False Positive Rate (1-specificity) at various classification strategies. The results obtained from [25] compared to this study were
thresholds. Four algorithms (DT, RF, KNN, and GB) achieved perfect marginal, however, they achieved state-of-the-art performance using
classification with AUC = 1.00, shown by their overlapping curves at the simpler algorithms compared to complex deep learning or hybrid ap­
top of the plot while LR performed slightly lower with AUC = 0.87, proaches. The high performance across multiple metrics suggests robust
shown by the purple curve. This visualization effectively shows that and reliable detection capabilities. Based on duplicates and constant
while all models performed well, the tree-based and neighbourhood- values removal which was not considered by the existing works that
based algorithms achieved optimal classification performance for our used this technique, the results showed that removing duplicates helped
network intrusion detection task. prevent overfitting without sacrificing the performance of the algo­
DT and RF emerged as the top-performing algorithms, both rithms and duplicate instances in the dataset did not contribute signif­
achieving high accuracy rates above 0.999. This was also the case in icant information to the learning process. This work establishes a strong
[18] and [16]. This performance can be traced to algorithms’ ability to foundation for future developments in network intrusion detection and
capture complex, non-linear relationships in the feature space and their demonstrates that significant improvements in detection capabilities
robustness to noise. This is followed by GB while boosting effectively can be achieved through careful algorithm selection and data pre­
reduces bias, it does not give a significant advantage over tree-based processing rather than solely through increasing model complexity.
algorithms in this task. Network intrusion detection datasets are often Future research would investigate the robustness of these models
imbalanced, with most instances belonging to benign traffic and a mi­ against adversarial attacks and concept drift, which is crucial as network
nority representing intrusion attempts. Training the algorithms on traffic patterns and cyber threats continuously evolve. This study es­
imbalanced data can lead to biased predictions, where the model favours tablishes the foundation for real-time applicability. However, future
the majority class, achieving high accuracy but failing to detect in­ work will also focus on optimizing the models for real-time deployment
trusions (minority class) by comparing results from the imbalanced by exploring scalable frameworks, such as edge or cloud computing, to
dataset, one can highlight the limitations of using imbalanced data for support real-time intrusion detection.
training. Comparing the results from balanced and imbalanced datasets
demonstrates the improvement in model performance (e.g., higher 4. Conclusions
recall, F1 score) when applying balancing techniques. This comparison
helps justify the choice of balancing the dataset as an effective pre­ This research presents a comprehensive evaluation of machine
processing step for intrusion detection tasks. learning algorithms for network intrusion detection systems (NIDS),
Given the impressive performance results, a comparative analysis providing significant contributions to the field of network security. Tree-
was conducted against other studies that used the same dataset. This based methods (Decision Trees and Random Forest) demonstrated
comparison assessed the proposed approach against alternative meth­ exceptional performance, achieving accuracy rates above 0.999 and
odologies, using metrics such as accuracy, precision, recall, and F1-score perfect AUC scores of 1.00 while maintaining computational efficiency.
as evaluation criteria. The results highlight the effectiveness and supe­ This study demonstrates that simpler, interpretable models can achieve
riority of the proposed method in detecting intrusions in cloud state-of-the-art performance in network intrusion detection. It would be
interesting in future research to investigate the robustness of these
models against adversarial attacks and concept drift.

CRediT authorship contribution statement

Dauda Adeite Adenusi: Writing – review & editing, Writing –

original draft, Data curation, Supervision, Project administration,
Conceptualization, Methodology. Oladosu Oyebisi Oladimeji: Meth­
odology, Writing – original draft, Conceptualization, Writing – review &
editing. Theopilus Adekunle Oyekola: Data curation, Conceptualiza­
tion, Writing – original draft. Korede Solomon Olagunju: Supervision,

Table 3
Comparison of this research results with existing literature results.
Ref Algorithm Accuracy Precision Recall F1-Score

[17] Deep AE + CNN - 0.988 0.998 0.987

[18] PCA + ET 0.9992 0.9996 0.9991 0.9993
[16] RF 0.98 0.99 0.98 0.99
[22] Birch+MLP 0.9973 0.9973 0.9973 0.9973
Fig. 2. The receiver operating characteristic (ROC) curve, depicted in various
This study RF+DEUB 0.9997 0.9991 0.9997 0.9992
colours for the different machine learning algorithms.

4
D.A. Adenusi et al. Franklin Open 12 (2025) 100339

Writing – review & editing. [11] [Link] Kurniabudi, [Link] Bin Idris Darmawijoyo, A.M. Bamhdi, R. Budiarto,
CICIDS-2017 dataset feature analysis with information gain for anomaly detection,
IEEE Access 8 (2020), [Link]
[12] V. Priyanka, [Link] Kumar, Performance assessment of IDS based on CICIDS-
Declaration of competing interest 2017 dataset. Lecture Notes in Networks and Systems, 2022, [Link]
10.1007/978-981-16-0739-4_58.
The authors declare that they have no known competing financial [13] S.S. Panwar, Y.P. Raiwani, L.S. Panwar, An intrusion detection model for CICIDS-
2017 dataset using machine learning algorithms, in: 2022 International Conference
interests or personal relationships that could have appeared to influence on Advances in Computing, Communication and Materials, ICACCM 2022, 2022,
the work reported in this paper. [Link]
[14] I. Sharafaldin, A.H. Lashkari, A.A. Ghorbani, Toward generating a new intrusion
detection dataset and intrusion traffic characterization, in: ICISSP 2018 -
References Proceedings of the 4th International Conference on Information Systems Security
and Privacy, 2018, [Link]
[1] H. Rajadurai, U.D. Gandhi, An empirical model in intrusion detection systems [15] S.S. Gopalan, D. Ravikumar, D. Linekar, A. Raza, M. Hasib, Balancing approaches
using principal component analysis and deep learning models, Comput. Intell. 37 towards ML for IDS: A survey for the CSE-CIC IDS dataset, in: ICCSPA 2020 - 4th
(3) (2021), [Link] International Conference on Communications, Signal Processing, and their
[2] M.A. Khan, HCRNNIDS: hybrid convolutional recurrent neural network-based Applications, 2021, [Link]
network intrusion detection system, Processes 9 (5) (2021), [Link] [16] K. Ibrahimi, M. Jouhari, Z. Jakout, Enhancing intrusion detection systems using
10.3390/pr9050834. machine learning classifiers on the CSE-CIC-IDS2018 dataset, in: 2024 11th
[3] A.R.B. Gupta, J. Agrawal, Machine learning-based intrusion detection system with International Conference on Wireless Networks and Mobile Communications
recursive feature elimination. Lecture Notes in Networks and Systems, 2021, (WINCOM), IEEE, Jul. 2024, pp. 1–6, [Link]
[Link] WINCOM62286.2024.10655131.
[4] Z. Ahmad, A. Shahid Khan, [Link] Shiang, J. Abdullah, F. Ahmad, Network [17] R. S, S. V, An improving intrusion detection model based on novel CNN technique
intrusion detection system: A systematic study of machine learning and deep using recent CIC-IDS datasets, in: 2024 International Conference on Distributed
learning approaches, Trans. Emerg. Telecommun. Technol. 32 (1) (2021), https:// Computing and Optimization Techniques (ICDCOT), IEEE, Mar. 2024, pp. 1–6,
[Link]/10.1002/ett.4150. [Link]
[5] X. Zhao, K.W. Fok, V.L.L. Thing, Enhancing network intrusion detection [18] N.T. Cam, N.G. Trung, An intelligent approach to improving the performance of
performance using generative adversarial networks, Comput. Secur. 145 (Oct. threat detection in IoT, IEEE Access 11 (2023), [Link]
2024) 104005, [Link] ACCESS.2023.3273160.
[6] M. Injadat, A. Moubayed, A.B. Nassif, A. Shami, Multi-stage Optimized Machine [19] J. Mishra, S.K. Sahay, H. Rathore, L. Kumar, Duplicates in the drebin dataset and
Learning framework for network intrusion detection, IEEE Trans. Netw. Serv. reduction in the accuracy of the malware detection models, in: Proceeding - 2021
Manag. 18 (2) (2021), [Link] 26th IEEE Asia-Pacific Conference on Communications, APCC 2021, 2021, https://
[7] Kang Leng Chiew, Bian Hui, An improved network intrusion detection method [Link]/10.1109/APCC49754.2021.9609892.
based on CNN-LSTM-SA, J. Adv. Res. Appl. Sci. Eng. Technol. 44 (1) (Apr. 2024) [20] O.O. Oladimeji, A. Oladimeji, O. Oladimeji, Classification models for likelihood
225–238, [Link] prediction of diabetes at early stage using feature selection, Appl. Comput.
[8] M. Tahir, A. Abdullah, N.I. Udzir, K.A. Kasmiran, A novel approach for handling Informatics 20 (3–4) (2024) 279–286, [Link]
missing data to enhance network intrusion detection system, Cyber Secur. Appl. 3 0022.
(Dec. 2025) 100063, [Link] [21] M. Hammad, M.H. Alkinani, B.B. Gupta, A.A. Abd El-Latif, Myocardial infarction
[9] N. Chaurasia, M. Ram, P. Verma, N. Mehta, N. Bharot, A federated learning detection based on deep neural network on imbalanced data. Multimedia Systems,
approach to network intrusion detection using residual networks in industrial IoT 2022, [Link]
networks, J. Supercomput. 80 (13) (Sep. 2024) 18325–18346, [Link] [22] Y. Yin, J. Jang-Jaccard, F. Sabrina, J. Kwak, Improving multilayer-perceptron
10.1007/s11227-024-06153-2. (MLP)-based network anomaly detection with Birch clustering on CICIDS-2017
[10] Z. Chen, M. Simsek, B. Kantarci, M. Bagheri, P. Djukic, Machine learning-enabled dataset, in: 2023 26th International Conference on Computer Supported
hybrid intrusion detection system with host data transformation and an advanced Cooperative Work in Design (CSCWD), IEEE, May 2023, pp. 423–431, [Link]
two-stage classifier, Comput. Networks 250 (Aug. 2024) 110576, [Link] org/10.1109/CSCWD57460.2023.10152640.
10.1016/[Link].2024.110576.