(IJACSA) International Journal of Advanced Computer Science and Applications,

Vol. 16, No. 8, 2025

Intrusion Detection Using Machine Learning and

Deep Learning
Fatima Jobran ALzaher, Asma AlJarullah
Department of Informatics and Computer Systems, King Khalid University, 61421, Alfara, Abha, Saudi Arabia

Abstract—As cyberattacks grow in prevalence, Intrusion attacks originating from the type of phishing attack that occurs
Detection Systems (IDS) have become critical for securing with the use of phish emails [1]. The ransomware attacks grew
network infrastructures. This study proposes an efficient IDS with 70% of the attacks focusing on the small business market
framework utilizing both machine learning (ML) and deep and the number of ransomware teams actively present more than
learning (DL) algorithms. The framework is evaluated on the “NF- doubling year over year [1].
UNSW-NB15-v2” dataset, which comprises a blend of normal and
malicious traffic. A diverse set of advanced models—including Adversaries now leverage automation and AI to accelerate
Deep Neural Networks (DNN), Long Short-Term Memory reconnaissance, weaponization, and evasion, fueling an arms
(LSTM) networks, eXtreme Gradient Boosting (XGBoost), race that compels defenders to adopt more adaptive, data-driven
Random Forest (RF), and K-Nearest Neighbors (KNN)—is countermeasures [2].
deployed for intrusion detection. The approach encompasses both
binary classification (normal vs. malicious) and multi-class Traditional intrusion detection systems (IDS) that rely on
classification (specific attack categories). Preprocessing steps static signatures or hand-crafted rules struggle with previously
include feature standardization using StandardScaler, class unseen or rapidly morphing threats [3]. Machine learning (ML)
imbalance correction via SMOTE, and dimensionality reduction and artificial intelligence (AI) enable dynamic threat modeling,
through Principal Component Analysis (PCA). Results show that anomaly detection, and behavioral analysis, allowing IDSs to
Random Forest and XGBoost models achieve high accuracy in generalize to novel attacks while reducing false positives [3].
binary classification with F1-scores approaching 0.97, while
XGBoost attains the best macro F1-score (0.71) in multi-class Despite notable advancements in IDS research, a critical
tasks. Additionally, RF and XGBoost demonstrate the fastest limitation persists across most studies: the insufficient handling
inference times, underscoring their suitability for real-time of class imbalance, which leads to poor detection rates for
deployment. This work contributes a scalable and optimized IDS minority attack types. Previous works have primarily focused on
pipeline for enhancing cybersecurity resilience. maximizing overall accuracy, often at the expense of rare class
detection, resulting in inflated performance metrics dominated
Keywords—Cybersecurity; cyber-attack; intrusion detection by frequent categories. Furthermore, inconsistencies in
system; machine learning; deep learning preprocessing pipelines, a lack of standardized evaluation on
modern NetFlow-based datasets like NF-UNSW-NB15-v2, and
I. INTRODUCTION the limited integration of a diverse set of both machine and deep
In recent years, the cyber world witnessed the most learning techniques within a single, optimized framework limit
phenomenal increase ever of cyber threats that targeted the robustness and practical applicability of existing IDS
individuals, businesses, and governments. The cost of solutions. This study aims to bridge these gaps by proposing an
cybercrime at the global level is anticipated at $9.5 trillion by integrated pipeline that combines SMOTE-based class
2024, which amounts to $26 billion per day or $18 million per balancing, PCA-driven feature reduction, and a comprehensive
minute [1]. The growing rate of cybercrime emphasizes the need evaluation of multiple ML and DL models to enhance minority
for proper cybersecurity controls. class detection and overall performance on the NF-UNSW-
NB15-v2 dataset.
Small and medium-sized businesses are most vulnerable
with 69% of these experiencing at least one cyber-attack within The remainder of the paper is organized as follows. Section
the past year [1]. Yet 80% of the SMBs are largely II reviews related work on ML/DL-based IDS. Section III details
unimplemented with the utilization of Privileged Access the methodology, including the dataset, preprocessing
Management solutions while fewer than 60% of the enterprises (standardization, imbalance handling, dimensionality reduction,
are using vital cybersecurity practices of password managers, and train–test split), model specifications, and evaluation
two-factor authentication, and cybersecurity education [1]. The metrics. Section IV reports the experimental results for both
shift toward remote work amplified the fear of security since binary and multi-class settings and examines inference-time
72% of businesses are concerned about the danger it presents performance for real-time applicability. Section V discusses key
and 80% of cybersecurity professionals confirm that the danger findings, practical implications, and limitations. Section VI
increased since 2020 [1]. concludes and outlines directions for future research.
Phishing and ransomware attacks grew more complex and II. RELATED WORK
more numerous. Security professionals saw 62% more phishing
Kasongo and Sun [4] conducted a performance analysis of
assaults within the recent years with 79% of account takeover
Intrusion Detection Systems (IDS) by applying a feature

440 | P a g e
[Link]
 (IJACSA) International Journal of Advanced Computer Science and Applications,
Vol. 16, No. 8, 2025

selection algorithm to the UNSW-NB15 dataset. They and compared over seven datasets, with the consequence that
emphasized the importance of reducing feature dimensionality single classifiers fall below both ensemble and hybrid classifiers
to enhance IDS accuracy. The study used five machine learning in terms of accuracy and detection performance. Comparison
classifiers—SVM, KNN, Logistic Regression, Artificial Neural between algorithms including SVM, DTs, RF, and Neural
Networks (ANN), and Decision Trees (DT)—and showed that Networks identifies that ensemble approaches, including
XGBoost-based feature selection significantly improved model stacking classifiers, have a significant impact in intrusion
performance, especially for DTs. However, the study did not detection improvement. Challenges include feature selection
address class imbalance, which led to lower F1-scores for improvement, testing over a range of and updated datasets, and
minority classes. minimizing false positive values. Optimizing hybrid models,
minimizing computational overload, and enhancing real-time
Kumar et al. [5] proposed an integrated rule-based IDS using intrusion capabilities have been suggested for future work,
both the UNSW-NB15 and RTNITP18 datasets. Their approach according to the authors.
employed Decision Tree classifiers (C5, CHAID, CART, and
QUEST) to detect five attack types: Generic, Probe, DoS, Samantaray et al. in [9] conducted a comparative study on
Exploit, and Normal. The study reported improved accuracy and ML model implementation in intrusion detection in IoT-based
reduced false alarm rates through rule-based modeling and networks. The research is centered on increasing threats in the
information gain-based feature selection. Nonetheless, it lacked security of IoT networks and the need to utilize efficient IDS in
proper handling of class imbalance and yielded low precision order to mitigate them. The research uses the “UNSW-NB15
and recall for critical attack types. (DS-1)” and “NF-UNSW-NB15 (DS-2)” datasets in comparing
models based on ML like SVM, KNN, Logistic Regression,
More et al. [6] compared several supervised ML techniques Naïve Bayes, DT, and RF. The feature scaling is based on a
for identifying deceitful emails with filtering approaches and method involving the usage of the MaxAbsScaler algorithm in
through use of the WEKA toolset. The work identifies a order to increase efficiency in classification. The results
weakness in conventional Bayesian filtering, effective in spam highlight the usage of the RF classifier in achieving the highest
filtering but not in high false positive cases. To counteract,
precision in generating the most accurate outcome with a gain in
several classifiers, such as RF and SVM, have been incorporated the rate of detection from 60% to 94% in the DS-2 dataset. The
and utilized for enhancing accuracy and minimizing false research focuses on efficiency in ML usage in intrusion
positives in classification. In its use, feature extraction via Naïve detection and supports future research on implementation with
Bayes and an evaluation tool developed in WEKA facilitated improved feature selection and DL.
testing of numerous algorithms for classification in a thorough
manner. Experimental tests showed that RF and SVM Sayed et al. in [10] conducted research with a focus on
performed better in enhancing positive and negative actual optimizing the efficiency of DNN-driven IoT intrusion detection
values and overall accuracy over 96%. The work identifies the systems (IDS). Because the IoT devices are under threat and
use of hybrid classification approaches in improving deceitful there is a limitation in the process ability and in features in
message detection and minimizing security threats posed security, the researchers provided two CNN models, namely
through spammers. IoTCNN and MyCNN, with a purpose to classify intrusion in
the network. The "NF-UNSW-NB15-v2" dataset was used in the
Tahri et al. [7] have designed an IDS with ML algorithms for research, and the stream network data was converted into RGB
enhancing network security. As communications through images in order to train the models. Results indicated the
electronic means have increased, IDS proves to be a useful tool efficiency of the models in the detection of various intrusion
for discovering hostile activity in network communications. In types, and in the majority of intrusion categories, the precision
the current work, three classifiers, Naïve Bayes, SVM, and of the models improved. The research confirms the efficiency of
KNN, have been compared for performance with two anomaly-based IoT security based on DL and calls for
benchmark datasets, namely, “NSL-KDD” and “UNSW- improvement in the handling of imbalances in the class and the
NB15”. In part one of work, three classifiers have been optimization of the hyperparameters.
compared with the use of “UNSW-NB15”, and then for a proper
analysis, best-performing algorithm is utilized for testing with Table I provides a structured summary of key related studies,
“NSL-KDD”. As per work, SVM outperforms all classifiers in highlighting the datasets, methodologies, and performance
terms of accuracy consistently, with 97.77% accuracy for metrics used, which helps position the present work within the
“UNSW-NB15” and 97.29% accuracy for NSL-KDD. In broader landscape of IDS research.
conclusion, SVM proves to be an effective intrusion detection
classifier, and future work will attempt to make its processing Despite notable advancements in IDS research, a recurring
efficient and integrate it in real-time security tools such as a limitation across most studies is the insufficient handling of
firewall. class imbalance and the resulting poor detection of minority
attack types. Previous works primarily focused on improving
Musa et al. [8] review the application of ML algorithms in overall accuracy without explicitly addressing the critical
IDS for enhancing network security through observation of challenge of rare class detection, often leading to inflated
traffic and intrusion activity, and IDS is distinguished between performance metrics dominated by frequent attack categories. In
anomaly-based and signature-based detection, with the first addition, inconsistencies in preprocessing, lack of standardized
identifying abnormalities in behavior and the second employing evaluation on newer datasets, and limited integration of deep
predefined attack signatures. Various types of ML approaches, learning techniques further limit the robustness of existing IDS
including single, hybrid, and ensemble classifiers, are contrasted solutions. Building on these gaps, this research proposes an

441 | P a g e
[Link]
 (IJACSA) International Journal of Advanced Computer Science and Applications,
Vol. 16, No. 8, 2025

integrated approach combining SMOTE-based class balancing, minority class detection and overall intrusion detection
PCA-driven feature selection, ML/DL modeling to enhance performance on the NF-UNSW-NB15-v2 dataset [20].

TABLE I. SUMMARY OF RELATED WORK

Machine
Learning /
Classification Performance
Year Research Title Dataset Deep Preprocessing Findings Limitations Ref
Type Metrics
Learning
Model(s)
Binary: Accuracy
90.85%, Precision
SVM, No class
Performance 80.33%, Recall Feature
KNN, Min-Max imbalance
analysis of IDS 98.38%, F1-score selection
Logistic normalization; handling;
using a feature UNSW- Binary and 88.45% (XGBoost)
2020 Regression, Feature poor F1- [4]
selection NB15 [21] Multi-class Multi-class: Accuracy improved ML
ANN, selection with scores for
method on 77.51%, Precision model
Decision XGBoost minority
UNSW-NB15 79.50%, Recall performance.
Tree classes.
77.53%, F1-score
77.28%
No class
An integrated
Feature imbalance
rule-based Decision
UNSW- selection using Rule-based handling;
intrusion Trees (C5, Accuracy 84.83%,
NB15 [21], Information modeling low
2020 detection system CHAID, Multi-class Approximate F1- [5]
RTNITP18 Gain; K- reduced false precision
on UNSW- CART, score 68.13%
[5] Means alarms in IDS. and recall
NB15 and QUEST)
clustering for critical
RTNITP18
attacks.
Ensemble
SpamBase Tokenization; No class
Random models
Evaluation of [22], Ling- Feature imbalance
Forest, Accuracy: RF 98.9%, (Random
deceptive mails Spam [23], extraction; handling;
2015 SVM, Binary SVM 98.4%, NB Forest) achieved [6]
using filtering & Enron [24], Term no minority
Naïve 93.2% high
WEKA PU1 [25], Frequency class
Bayes classification
PU2 [25] normalization evaluation.
accuracy.
Intrusion SVM achieved No class
Detection UNSW- SVM, Feature Binary: SVM high accuracy imbalance
System using NB15 [21], KNN, selection using Binary and Accuracy 97.78% on IDS datasets handling;
2022 [7]
machine NSL-KDD Naïve mutual Multi-class Multi-class: SVM without heavy no minority
learning [26] Bayes information; Accuracy 97.29% feature class
algorithms engineering. evaluation.
KDDCup'99
[27], NSL-
KDD [26], SVM, Dataset-
Review of Binary: Ensemble Ensemble
Kyoto2006+ Random specific No class
machine models achieved methods (e.g.,
[28], AWID Forest, feature imbalance
learning >99% Accuracy XGBoost)
[29], CIC- Decision engineering; Binary and handling;
2020 techniques for Multi-class: Accuracy consistently [8]
IDS2017 Tree, KNN, Standard Multi-class no minority
IDS across ~0.99, Macro F1 outperformed
[30], ANN, normalization class
different ~0.89 individual
UNSW- XGBoost, or scaling evaluation.
datasets classifiers.
NB15 [21], AdaBoost where needed
UGR'16
[31]
SVM,
Comparative
UNSW- KNN, No class
assessment of
NB15 (DS- Logistic Feature scaling imbalance
ML algorithms
1), NF- Regression, MaxAbsScaler Accuracy: RF 60% (MaxAbsScaler) handling;
2024 in IoT-based Multi-class [9]
UNSW- Naïve normalization (DS-1), 94% (DS-2) improved IDS no minority
network
NB15 (DS- Bayes, model stability. class
intrusion
2) [20] Random evaluation.
detection
Forest
CNNs using No class
Augmenting IoT FFT-based
NetFlow-to- imbalance
intrusion NetFlow Accuracy ~99%
NF-UNSW- image handling;
detection system transformation (frequent classes);
2022 NB15-v2 CNN Multi-class transformation poor F1- [10]
performance to RGB poor F1-scores for
[20] achieved high scores for
using deep images; Image minority classes
accuracy for minority
neural networks normalization
frequent attacks. classes.

442 | P a g e
[Link]
 (IJACSA) International Journal of Advanced Computer Science and Applications,
Vol. 16, No. 8, 2025

recall, F1-score, and AUC-ROC, to ensure robust and

III. METHODOLOGY comprehensive assessment of intrusion detection effectiveness.
The methodology for this project is structured into several
essential steps, as depicted in Fig. 1. B. Dataset
The NetFlow-based variant of the UNSW-NB15 dataset,
The proposed method for intrusion detection using deep referred to as NF-UNSW-NB15, incorporates additional flow-
learning (DL) and machine learning (ML) follows a structured level features and is labeled according to specific attack
pipeline: categories. The original dataset comprises 2,390,275 network
1) Dataset: The NF-UNSW-NB15 dataset is used, flow records, including 95,053 attacks (3.98%) and 2,295,222
comprising a combination of normal and malicious network benign flows (96.02%). These attack records are further divided
into nine subtypes, as summarized in Table II [19]. For this
traffic. It provides a realistic foundation for evaluating intrusion
study, the dataset was obtained from Kaggle, where the official
detection models. version was uploaded by the author after removing duplicate
Preprocessing Steps: rows, reducing the total count to 1,986,745. Therefore, the
dataset used in this research is consistent with the original
 Standardization: Normalizes the data to have the same release, except for the exclusion of duplicates to improve data
feature scaling. integrity and processing efficiency.
 PCA (Principal Component Analysis): Reduces Mohanad Sarhan et al. [20] proposed a standardized feature
dimensionality in a way that maximizes computational set for network intrusion detection datasets to improve detection
efficiency while retaining significant features. performance through the application of machine learning
 Oversampling: Balances the dataset and treats techniques. Their approach leverages NetFlow v9 features,
imbalances in classes, optimizing performance on which are widely supported by network devices and proven to
minority attack classes. be effective for traffic analysis. The proposed feature set
includes 43 numerical, flow-based attributes designed to
2) Model training: Preprocessed data is fed to ML (e.g., facilitate accurate and consistent detection of security events. By
XGBoost, RF, KNN) and DL (e.g., DNN, LSTM) models for promoting dataset standardization, this feature set simplifies
training. model evaluation, enhances compatibility for dataset merging,
3) Evaluation metrics: Model performance is evaluated and supports real-world deployment of intrusion detection
using conventional metrics, including accuracy, precision, systems.

Fig. 1. Proposed method.

TABLE II. ATTACK TYPES IN “NF-UNSW-NB15”

Class Count Description

Benign 2295222 Normal, non-malicious network traffic.
Fuzzers 22310 An attack where large volumes of random data are sent to a system to cause crashes and identify security vulnerabilities.
Analysis 2299 A category of threats targeting web applications through ports, emails, and scripts.
Backdoor 2169 A method that bypasses security mechanisms by responding to specially crafted client requests.
DoS 5794 An attack that overwhelms a system’s resources to disrupt access to its data or services.
Exploits 31551 Sequences of commands used to manipulate a system by exploiting known vulnerabilities.
Generic 16560 A cryptographic attack that causes collisions in block cipher encryption.
Reconnaissance 12779 Also known as probing, this technique involves gathering information about a network host.
Shellcode 1427 Malicious code designed to take control of a victim’s system.
Worms 164 Self-replicating attacks that spread across multiple computers.

443 | P a g e
[Link]
 (IJACSA) International Journal of Advanced Computer Science and Applications,
Vol. 16, No. 8, 2025

TABLE III. FEATURES IN “NF-UNSW-NB15”

Field Name Data Type Description

1 IPV4_SRC_ADDR String Source IPv4 address
2 IPV4_DST_ADDR String Destination IPv4 address
3 L4_SRC_PORT Integer Source port number for IPv4
4 L4_DST_PORT Integer Destination port number for IPv4
5 PROTOCOL Integer Byte value representing the IP protocol identifier
6 L7_PROTO Integer Numeric identifier for the Layer 7 protocol
7 IN_BYTES Integer Total incoming bytes
8 OUT_BYTES Integer Total outgoing bytes
9 IN_PKTS Integer Count of incoming packets
10 OUT_PKTS Integer Count of outgoing packets
11 FLOW_DURATION_MILLISECONDS Float Duration of the flow in milliseconds
12 TCP_FLAGS Integer Aggregated TCP flags
13 CLIENT_TCP_FLAGS Integer Aggregated TCP flags from the client side
14 SERVER_TCP_FLAGS Integer Aggregated TCP flags from the server side
15 DURATION_IN Float Duration of the client-to-server stream (in milliseconds)
16 DURATION_OUT Float Duration of the server-to-client stream (in milliseconds)
17 MIN_TTL Integer Minimum Time-to-Live (TTL) value observed in the flow
18 MAX_TTL Integer Maximum Time-to-Live (TTL) value observed in the flow
19 LONGEST_FLOW_PKT Integer Size (in bytes) of the longest packet in the flow
20 SHORTEST_FLOW_PKT Integer Size (in bytes) of the shortest packet in the flow
21 MIN_IP_PKT_LEN Integer Length of the smallest observed IP packet in the flow
22 MAX_IP_PKT_LEN Integer Length of the largest observed IP packet in the flow
23 SRC_TO_DST_SECOND_BYTES Float Rate of bytes sent from source to destination (bytes per second)
24 DST_TO_SRC_SECOND_BYTES Float Rate of bytes sent from destination to source (bytes per second)
25 RETRANSMITTED_IN_BYTES Integer Count of retransmitted TCP bytes from source to destination
26 RETRANSMITTED_IN_PKTS Integer Count of retransmitted TCP packets from source to destination
27 RETRANSMITTED_OUT_BYTES Integer Count of retransmitted TCP bytes from destination to source
28 RETRANSMITTED_OUT_PKTS Integer Count of retransmitted TCP packets from destination to source
29 SRC_TO_DST_AVG_THROUGHPUT Float Average throughput (bps) from source to destination
30 DST_TO_SRC_AVG_THROUGHPUT Float Average throughput (bps) from destination to source
31 NUM_PKTS_UP_TO_128_BYTES Integer Number of packets with an IP size of 128 bytes or less
32 NUM_PKTS_128_TO_256_BYTES Integer Number of packets with an IP size between 128 and 256 bytes
33 NUM_PKTS_256_TO_512_BYTES Integer Number of packets with an IP size between 256 and 512 bytes
34 NUM_PKTS_512_TO_1024_BYTES Integer Number of packets with an IP size between 512 and 1024 bytes
35 NUM_PKTS_1024_TO_1514_BYTES Integer Number of packets with an IP size between 1024 and 1514 bytes
36 TCP_WIN_MAX_IN Integer Maximum TCP window size from source to destination
37 TCP_WIN_MAX_OUT Integer Maximum TCP window size from destination to source
38 ICMP_TYPE Integer ICMP type combined with ICMP code (ICMP Type * 256 + ICMP Code)
39 ICMP_IPV4_TYPE Integer ICMP type identifier for IPv4
40 DNS_QUERY_ID Integer Transaction ID of a DNS query
41 DNS_QUERY_TYPE Integer Type of DNS query (e.g., 1 = A, 2 = NS, etc.)
42 DNS_TTL_ANSWER Integer Time-to-Live (TTL) value of the first A record, if available
43 FTP_COMMAND_RET_CODE Integer Return code for an FTP client command

Table III lists the feature set of the NF-UNSW-NB15 types, “Exploits” and “Fuzzers” appear most frequently, while
dataset, detailing the flow characteristics captured for intrusion others such as “Reconnaissance,” “DoS,” and especially
detection analysis. “Worms” occur far less often. This imbalance poses challenges
for accurate model training and may necessitate the use of
Fig. 2 illustrates the significant class imbalance in the resampling methods or advanced techniques to improve
dataset, with benign (normal) traffic overwhelmingly detection performance, particularly for minority attack classes.
dominating all categories of malicious traffic. Among the attack

444 | P a g e
[Link]
 (IJACSA) International Journal of Advanced Computer Science and Applications,
Vol. 16, No. 8, 2025

Fig. 2. Attack column distribution.

Fig. 4. Count of every attack type.
Fig. 3 displays how normal and malicious flows are
distributed in the dataset, revealing a pronounced class C. Dataset Preprocessing
imbalance: legitimate traffic vastly outweighs attack traffic. To ensure high-quality input for model training, the NF-
UNSW-NB15-v2 dataset undergoes a series of preprocessing
Such skew can hamper model effectiveness, so remedies like steps designed to enhance learning efficiency and model
SMOTE oversampling or class-weight adjustment are advisable performance.
to achieve more reliable classification.
1) Standardization: Standardization was applied using the
StandardScaler, which transformed each numerical feature to
have a mean of zero and a standard deviation of one. This
normalization process ensured that all features contributed
proportionally to the learning process, preventing any single
feature with a large magnitude from disproportionately
influencing the model. Standardization was particularly
important for algorithms sensitive to feature scale, such as K-
Nearest Neighbors (KNN) and Deep Neural Networks (DNN),
which rely on distance-based calculations and gradient-based
optimization, respectively. This approach follows best practices
outlined in prior literature and common implementations such
as scikit-learn [11].
2) Handling class imbalance: To address the class
imbalance issue in the dataset, the Synthetic Minority Over-
sampling Technique (SMOTE) [32] was applied exclusively to
the training set after splitting the data into 70% for training and
30% for testing. This approach was intentionally adopted to
prevent data leakage and to ensure an unbiased evaluation of
the model’s performance on unseen data.
Fig. 3. Label column distribution. SMOTE generates synthetic samples for minority classes by
interpolating between existing instances rather than simply
Fig. 4 shows the distribution of different types of attacks in duplicating them. For each minority sample in the training set,
the dataset. "Exploits" is the highest frequency type, with the algorithm identifies its k-nearest neighbors (commonly k=5)
"Fuzzers" and "Reconnaissance" following, and "Worms" and within the same class. It then selects one neighbor at random and
"Analysis" are the least frequent. The imbalanced distribution creates a new instance by generating a point along the feature-
among attack types implies the need for careful model training space line segment connecting the original sample and its
in order to correctly identify in every category. neighbor. This synthetic instance inherits the statistical

445 | P a g e
[Link]
 (IJACSA) International Journal of Advanced Computer Science and Applications,
Vol. 16, No. 8, 2025

characteristics of both points, resulting in a new example that is An initial correlation analysis of the raw NetFlow features
both realistic and non-redundant [32]. revealed strong linear relationships among several variables. For
instance, IN_PKTS and OUT_PKTS exhibited a Pearson
By enriching the training set with these synthetic examples, correlation coefficient of approximately 0.99, while
the class distribution becomes more balanced. This allows FLOW_DURATION_MILLISECONDS was highly correlated
learning algorithms to be exposed to a wider variety of patterns with both DURATION_IN and DURATION_OUT. Similarly,
and variations within the minority classes, which enhances their MIN_TTL and MAX_TTL showed correlations exceeding 0.90.
ability to generalize and improves detection of rare attack types. These relationships, visualized in Fig. 5, support the application
The test set was left untouched to preserve the original of PCA to reduce multicollinearity and noise within the dataset.
distribution and maintain the integrity of the evaluation.
To validate the independence of the PCA components, a
3) Dimensionality reduction: To address the high correlation matrix was generated to examine the relationships
dimensionality of the dataset, which consists of 43 flow-based between the extracted components. As shown in Fig. 6, the
NetFlow features, Principal Component Analysis (PCA) was components are effectively uncorrelated, demonstrating that
employed as an effective dimensionality reduction technique. PCA successfully transforms the original feature space into a set
PCA transforms the original feature set into a smaller number of orthogonal, linearly independent dimensions. This
of uncorrelated components while retaining the majority of the orthogonality reinforces PCA’s suitability for improving model
data’s variance. This transformation reduces computational robustness and reducing feature redundancy.
complexity, accelerates model training, and mitigates the risk Overall, PCA proved especially beneficial for ensemble
of overfitting by eliminating redundant or less informative models such as Random Forest and XGBoost, which can be
attributes [13]. negatively affected by irrelevant or highly correlated features.
Its use enhanced model focus, reduced overfitting, and improved
interpretability within the intrusion detection pipeline.

Fig. 5. Correlation heatmap of original NetFlow features.

446 | P a g e
[Link]
 (IJACSA) International Journal of Advanced Computer Science and Applications,
Vol. 16, No. 8, 2025

Fig. 6. Correlation between PCA Components (with self-correlation).

4) Train-test split: To evaluate model performance fairly, b) Random Forests (RF): RF is a versatile algorithm in
the dataset is divided into distinct subsets. For traditional ML, famous for reducing the effect of overfitting, a prevalent
machine learning models, the dataset is partitioned into 70% for problem in decision trees (DTs). It performs tasks such as
training and 30% for testing to evaluate generalization classification, regression, and others by building many DTs
performance on unseen data. In the case of deep learning during the training period. The algorithm works by evaluating
models such as LSTM and DNN, the dataset is further divided multiple distinct decision trees (DTs) and making the prediction
into 70% for training and 30% for testing, enabling effective through a voting mechanism. Unlike in the case of a standard
monitoring during training and ensuring robust model DT, in which each internal node gets partitioned by the optimal
evaluation. attribute, RF uses the optimal attribute from a random subset of
predictors at each internal node. This randomization serves to
D. Modeling enhance model generalization and resistance, and the resulting
1) Machine learning models: Random Forest (RF), KNN, algorithm is a versatile tool in numerous applications in ML.
XGBoost, and SVM are the most effective ML models for the c) XGBoost (XGB): XGBoost (XGB) is a Gradient Tree
detection of intrusions. The models are good for classification Boosting algorithm powerful enough to solve heavy-scale ML
with feature-extracted input but are inefficient with complex problems in an efficient and effective manner. It possesses great
temporal relationships within sequential input. prediction precision and model training speed, and it's the
a) K-Nearest Neighbor (KNN): The KNN algorithm is a leading performer in all the competitions at Kaggle. The
supervised algorithm in ML most commonly used to classify mechanism in XGB lies in the addition of trees in an iterative
tasks [11]. It identifies the unlabeled data by considering the fashion and the division of the features during the course of the
label and the available training data's features. The algorithm expansion in the tree. The model learns to fit the residuals from
identifies the data by determining the point's nearest neighbors the last prediction each time a new tree gets added [13]. Given
and the final label by majority voting. Among all the algorithms an input 𝑥𝑖 , a true label 𝑦𝑖 , and a raw prediction 𝑧𝑖 before
in ML, the algorithm in the case of the KNN algorithm is unique applying the sigmoid function, according to [14], the XGBoost
in terms of ease and interpretability and, in turn, acts to be a model defines its objective function in the following equation:
(𝑡−1)
commonly used algorithm to classify tasks [12]. Even despite 𝐿(𝑡) = ∑𝑛𝑖=1 𝑙 (𝑦𝑖 , 𝑍𝑖 + 𝑓𝑡 (𝑥𝑖 )) + 𝛺(𝑓𝑡 ) + 𝑐
the ease, the algorithm performs exceptionally in the case of
solving the classification and the regression problems in Where 𝑙(.,.) represents the loss function, t denotes the t-th
different datasets, regardless of size, label distribution, the tree, and Ω serves as a penalty for model complexity. The term
datasets' noise, and the datasets' ranges [12]. 𝛺(𝑓𝑡 ) refers to the regularization penalty, while c is a constant.

447 | P a g e
[Link]
 (IJACSA) International Journal of Advanced Computer Science and Applications,
Vol. 16, No. 8, 2025

The second-order Taylor expansion is given by: b) Long Short-Term Memory (LSTM): The LSTM layer is
a special kind of [18] RNN, and the main job of the LSTM layer
𝑓(𝑥 + 𝛥𝑥) ≈ 𝑓(𝑥) + 𝑓 ′ (𝑥)𝛥𝑥 + 1⁄2 𝑓 ′′ (𝑥)𝛥𝑥 2 
is to handle sequence data with temporal relationships, such as
By substituting Eq. (2) into Eq. (1), we can obtain the text and relation data. The LSTM layer consists of three gates,
following result. the forget gate, the output gate, and the input gate, and the shared
1 2 state. The use equation and the LSTM layer's detailed working
𝐿(𝑡) ≈ ∑𝑛𝑖=1 [𝑙(𝑦𝑖 + 𝑍𝑖(𝑡−1) ) + 𝑔𝑖 𝑓𝑡 (𝑥𝑖 ) + ℎ𝑖 (𝑓𝑡 (𝑥𝑖 )) ]  are presented in the following equations:
2
𝑓𝑠 = 𝜎(𝑊𝑓 ⋅ [ℎ𝑠−1 , 𝑥𝑠 ] + 𝑏𝑓 ) 
where 𝑔𝑖 = 𝜕 𝐿⁄𝜕 𝑧𝑖 , and ℎ𝑖 = 𝜕 2 𝐿⁄𝜕 𝑧𝑖2 . By eliminating
the constant terms, we derive the following simplified objective 𝑖𝑠 = 𝜎(𝑊𝑓 ⋅ [ℎ𝑠−1 , 𝑥𝑠 ] + 𝑏𝑖 )
at step 𝑡.
𝐶´ = 𝑡𝑎𝑛ℎ(𝑊𝑐 ⋅ [ℎ𝑠−1 , 𝑥𝑠 ] + 𝑏𝐶 )
1 2
𝐿(𝑡) ≈ ∑𝑛𝑖=1 [𝑔𝑖 𝑓𝑡 (𝑥𝑖 ) + ℎ𝑖 (𝑓𝑖 (𝑥𝑖 )) ] + 𝛺(𝑓𝑡 )
2 𝐶𝑠 = 𝑓𝑠 ⋅ 𝐶𝑠−1 + 𝑖𝑠 ⋅ 𝐶´ 
The terms 𝑔𝑖 and ℎ𝑖 play a vital role in optimizing the 𝑜𝑠 = (𝑊𝑜 [ℎ𝑠−1 , 𝑥𝑠 ] + 𝑏𝐶 )
XGBoost training process. For binary classification, the model
typically employs cross-entropy (CE) as its default loss function. ℎ𝑠 = 𝑜𝑠 ⋅ 𝑡𝑎𝑛(𝐶𝑠 ) 
𝐿= − ∑𝑛𝑖=1[𝑦𝑖 𝑙𝑜𝑔(𝑦´𝑖 ) − (1 − 𝑦𝑖 )𝑙𝑜𝑔(1 − 𝑦´𝑖 )] The input gate controls how the LSTM cell state acquires the
information, in Eq. (9). The forget gate controls how the LSTM
In Eq. (5), 𝑦´𝑖 = 1⁄[1 + 𝑒𝑥𝑝(−𝑧𝑖 )] , that is sigmoid is cell state forget the information, in the Eq. (8). The cell state
selected as activation. Therefore, we can get: updates by the Eq. (10) and Eq. (11).
𝜕 𝑦´𝑖 ⁄𝜕 𝑧𝑖 = 𝑦´𝑖 (1 − 𝑦´𝑖 ) Output Layer:
2) Deep learning models: Deep-learning methods often fall The output layer generates the predicted sentiment
under the umbrella of unsupervised pre-trained networks— classification of the comment. The final output vector is scaled
architectures that stack many more layers and parameters than using the softmax activation function to produce a probability
typical machine-learning neural nets, earning them the distribution across each class. The equation is as follows:
designation “deep.” 𝑦 = 𝑠𝑜𝑓𝑡𝑚𝑎𝑥(𝑊ℎ𝑓𝑐 + 𝑏)
a) Deep Neural Network (DNN): An Artificial Neural
Network (ANN) is a model based on the structure and function E. Evaluation Metrics
of the brain [15]. Since neural networks (NN) are powerful 1) Confusion matrix: It's a matrix to represent how model
nonlinear discriminators in the event of problems in classify dataset, also to use to check how good the model's
classification, because they are able to describe any decision performance of classification. It's comprised by four
boundary in the feature space [16]. In recent years, Deep Neural components.
Networks (DNNs) gained significant interest in intrusion
detection research and evolved from Shallow Neural Networks In a confusion-matrix context, true positives (TP) are cases
(SNNs). The feature abstraction ability in DNNs and the ability where an instance is genuinely positive and the model correctly
to represent highly complex patterns make them extremely labels it as such, whereas true negatives (TN) are instances that
useful in applications in DL. Because of their ability to represent are truly negative and rightly classified as negative. By contrast,
false positives (FP) occur when a genuinely negative instance is
data in a good way, DNNs are in high demand in order to design
mistakenly flagged as positive, and false negatives (FN) arise
efficient and robust solutions.
when a genuinely positive instance is incorrectly marked as
The results are produced in a DNN based on the connection negative.
weights and activation functions in the neurons. The DNN is
composed of multiple processing layers, and every layer 2) ROC Curve (Receiver Operating Characteristic Curve):
contributes to decision-making and feature extraction. Several A graph that shows classification performance across all
hyperparameters dictate the operation of a DNN and are to be thresholds by plotting the true-positive rate (TPR) against the
determined in advance, including the number of units, number false-positive rate (FPR), illustrating the trade-off between
of layers, weights and bias initializers, activation function, sensitivity and specificity.
regularizer's coefficient, learning rate, and the optimizer. In this 3) Score: The harmonic mean of precision and recall; a
DNN model, ReLU activation is applied in the input layer and
single, balanced metric that is especially informative when
in every hidden layer. The ReLU function is a piecewise linear
function and returns the same input in the situation where the class distributions are unbalanced. It ranges between 0 and 1,
input is a positive number and a value of zero in the situation and 1 in the event of optimal precision and recall.
where the input is a negative number [17]. The neurons activated 2∗ Precision ∗ Recall
by this function are also rectified linear activation units. F1 Score = (15)
Precision + Recall

𝑅𝑒𝐿𝑈(𝑥) = 𝑚𝑎𝑥(0, 𝑥) 

448 | P a g e
[Link]
 (IJACSA) International Journal of Advanced Computer Science and Applications,
Vol. 16, No. 8, 2025

4) Accuracy: The rate of correctly classified observations Moreover, AUC scores, which evaluate a model’s ability to
over the total observations. It is a helpful indicator in the distinguish between classes, were also affected. Deep learning
situation where false positives and false negatives are equally models such as DNN and LSTM yielded relatively lower AUCs
distributed. in the range of 0.90–0.92, suggesting less reliable separability
between benign and malicious traffic. In contrast, ensemble
Accuracy =
Number of Correct Predictions
(16) models like Random Forest and XGBoost performed better,
Total Number of Predictions achieving AUC scores around 0.98. Nevertheless, even these
models demonstrated measurable improvements after applying
5) Precision: The proportion of the total predicted positives
SMOTE.
actually being positives. The higher the precision, the lower the
rate of the incorrect positives, and the lowest the incorrect These findings confirm that SMOTE plays a critical role not
positives. only in enhancing recall and F1-scores but also in improving the
True Positives overall discriminative power of classifiers, as reflected in AUC
Precision = (17) metrics. Table V summarizes the performance of LSTM, DNN,
True Positives + False Positives
Random Forest, KNN, and XGBoost on the binary classification
6) Recall: The ratio of correctly predicted positive task prior to applying SMOTE.
instances to all actual positive instances. A higher recall
indicates fewer missed positives and a lower rate of false After applying SMOTE, all models demonstrate strong
performance, with Random Forest and KNN achieving high
negatives.
True Positives
accuracy and F1-scores. While LSTM and DNN yield slightly
Recall = (18) lower precision for the Attack class, they still achieve perfect
True Positives + False Negatives
recall, indicating high sensitivity to positive cases. The AUC
IV. RESULTS score of 0.99 or higher across all models confirms excellent
separability between classes. Among all models, RF achieved
This section presents how a range of ML and DL models
the best overall performance with an F1-score of 0.97, and
performed on binary and multi-class intrusion-detection tasks
using the “NF-UNSW-NB15” dataset. Before training, we highly balanced precision and recall values, especially for class
applied PCA to cut dimensionality and boost both speed and 1 (Attack class). Its confusion matrix is very high, showing low
misclassificationwith 2308 false positives and 199 false
accuracy. Every model was tuned with the same hyper-
negative, Fig. 7 shows Random Forest confusion matrix that
parameter settings to keep the comparison fair. Their
effectively classified both Normal and Attack classes, making it
effectiveness was gauged with a full suite of metrics—accuracy,
the most reliable model for the binary classification task.
precision, recall, F1-score, AUC, and confusion matrices—so
we could see each algorithm’s strengths and weaknesses in TABLE IV. HYPERPARAMETER SETTINGS
detail. Results are split into two categories: binary detection of
normal versus malicious traffic, and multi-class detection that Parameter Value
pinpoints the exact attack type. Epochs 20
A. Hyperparameter Configuration Batch Size 128
All deep learning models (LSTM and DNN) were trained Learning Rate 0.001
using a fixed set of hyperparameters to ensure a fair and
Optimizer Adam
consistent comparison. For binary classification tasks, the loss
function employed was binary crossentropy, while sparse Loss Function (Binary) Binary Crossentropy
categorical crossentropy was used for multi-class classification. Loss Function (Multi) Sparse Categorical Crossentropy
Model optimization was performed using the Adam optimizer
PCA Components (Binary and Multi) 20
with a learning rate of 0.001. Both tasks were trained over 20
epochs with a batch size of 128. Additionally, early stopping was
applied based on validation loss to prevent overfitting and TABLE V. BINARY CLASSIFICATION PERFORMANCE WITHOUT SMOTE
ensure optimal generalization performance. Model Accuracy Precision Recall F1-score AUC
Table IV presents the hyperparameter settings used for LSTM 0.99 0.97 0.92 0.94 0.92
model training, including learning configuration, optimization
DNN 0.99 0.97 0.90 0.93 0.90
strategy, and loss functions for both binary and multi-class tasks.
RF 0.99 0.97 0.98 0.98 0.98
B. Binary Classification Results
KNN 0.99 0.95 0.95 0.94 0.95
Before applying SMOTE, all models achieved high overall
accuracy (0.99); however, recall and F1-scores—particularly for XGBoost 0.99 0.96 0.97 0.97 0.98
the minority class—were comparatively lower. For instance, the
Fig. 8 shows LSTM confusion matrix for classifying both
LSTM model achieved a recall of 0.92 and an F1-score of 0.94,
Normal and Attack classes.
while the DNN model recorded a recall of 0.90. These results
indicate reduced sensitivity to minority class detection due to the
dataset’s class imbalance.

449 | P a g e
[Link]
 (IJACSA) International Journal of Advanced Computer Science and Applications,
Vol. 16, No. 8, 2025

Fig. 9. DNN confusion matrix.

Fig. 7. RF confusion matrix.
Fig. 10 shows KNN confusion matrix for classifying both
Normal and Attack classes.

Fig. 8. LSTM confusion matrix.

Fig. 10. KNN confusion matrix.
The confusion matrix of the LSTM model reveals strong
sensitivity in detecting attacks, although a slight increase in false The KNN confusion matrix indicates good accuracy, with
positives indicates a trade-off in precision. slightly higher misclassification of Normal status.
Fig. 9 shows DNN confusion matrix for classifying both Fig. 11 shows XGBoost confusion matrix for classifying
Normal and Attack classes. both Normal and Attack classes.
This matrix illustrates the DNN model's good performance, XGBoost exhibits high precision and recall, evident in its
with solid detection capability and also slight false alarm rate, compact and clearly defined confusion matrix blocks with 2164
reflecting effective learning of attack patterns. false positives and 239 false negatives, signifying high
discriminative power.

450 | P a g e
[Link]
 (IJACSA) International Journal of Advanced Computer Science and Applications,
Vol. 16, No. 8, 2025

Model performances vary more noticeably in the multi-class

setting. LSTM and DNN, while achieving high overall accuracy
due to class imbalance in test set, show lower macro-averaged
F1-scores, indicating challenges in learning minority classes. In
contrast, Random Forest and XGBoost perform robustly across
all classes, benefiting from ensemble-based learning. KNN also
performs competitively but with slightly lower recall. The
XGBoost classifier emerged as a competitive performer in the
multi-class setting, achieving a macro F1-score (0.71), reflecting
moderate performance across most classes, including minority
ones. The confusion matrix of XGBoost reflects moderate
performance on minority classes such as 6, 7, 8, and 9 with
misclassifications, e.g., 919 false negatives for class 2 and 1455
for class 4 as shown in Fig. 12.
LSTM’s multi-class confusion matrix (Fig. 13) shows robust
classification for dominant classes but reveals some difficulty in
differentiating among minority attack types.

TABLE VII. MULTI-CLASS CLASSIFICATION MACRO-AVERAGED SCORES

WITHOUT SMOTE

Fig. 11. XGBoost confusion matrix. Model Accuracy Precision Recall F1-score AUC
LSTM 0.99 0.57 0.53 0.52 0.92
Table VI summarizes the performance of LSTM, DNN, RF,
KNN, and XGBoost on the binary classification task. DNN 0.99 0.10 0.10 0.10 0.50
RF 0.99 0.66 0.62 0.64 0.94
TABLE VI. BINARY CLASSIFICATION PERFORMANCE WITH SMOTE
KNN 0.99 0.61 0.58 0.59 0.87
Model Accuracy Precision Recall F1-score AUC
XGBoost 0.99 0.66 0.60 0.62 0.98
LSTM 0.99 0.94 0.99 0.97 0.99
DNN 0.99 0.94 0.99 0.96 0.99 TABLE VIII. MULTI-CLASS CLASSIFICATION MACRO-AVERAGED SCORES
RF 0.99 0.95 0.99 0.97 0.99 Model Accuracy Precision Recall F1-score AUC
KNN 0.99 0.95 0.99 0.97 0.99 LSTM 0.99 0.62 0.56 0.56 0.99
XGBoost 0.99 0.95 0.99 0.97 0.99 DNN 0.99 0.66 0.57 0.59 0.99

C. Multi-Class Classification Results RF 0.98 0.68 0.71 0.63 0.99

Unlike binary classification, the multi-class classification KNN 0.99 0.69 0.66 0.63 0.89
task suffered from noticeable performance degradation in the XGBoost 0.99 0.73 0.80 0.71 0.99
absence of SMOTE, especially in models like DNN, which
recorded extremely low precision, recall, and F1-score (all =
0.10) despite an overall accuracy of 0.99. This illustrates that
accuracy alone is misleading under class imbalance.
Similarly, LSTM showed moderate metrics (F1 = 0.52),
while Random Forest and XGBoost performed relatively better
(F1 = 0.64 and 0.62 respectively). AUC scores also reflected this
trend—DNN had a poor AUC of 0.50, while XGBoost reached
0.98. These results demonstrate the limitations of models when
trained on highly imbalanced data and reinforce the need for
resampling methods like SMOTE to achieve fair multi-class
performance across all attack types.
Table VII summarizes the performance of LSTM, DNN, RF,
KNN, and XGBoost on the multi-class classification task before
applying SMOTE.
Table VIII details the multi-class classification performance
across the same set of models after SMOTE.
Fig. 12. XGboost confusion matrix in multi-classification.

451 | P a g e
[Link]
 (IJACSA) International Journal of Advanced Computer Science and Applications,
Vol. 16, No. 8, 2025

Fig. 13. LSTM confusion matrix in multi-classification

Fig. 15. KNN confusion matrix in multi-classification.

The DNN model performs well across several classes, but
the confusion matrix reflects misclassification among minority
classes as shown in Fig. 14.

Fig. 16. Random forest confusion matrix in multi-classification.

Fig. 14. DNN confusion matrix in multi-classification. TABLE IX. PREDICTION TIME FOR EACH CLASSIFIER

The confusion matrix of KNN (Fig. 15) shows good Avg. Time per 1000
Model Task Total Time (s)
Records (s)
effectiveness, better than LSTM and DNN, but still less than
LSTM Binary 25 0.3575
Xgboost.
DNN Binary 20 0.0700
Random Forest delivers a compact and efficient confusion
matrix, excelling at distinguishing between multiple attack RF Binary 4.519 0.0076
types, especially frequent ones, while showing some overlap in KNN Binary 73.4142 0.1232
less-represented classes as shown in Fig. 16. XGBoost Binary 14.323 0.0240
D. Inference Time Evaluation for Real-Time Applicability LSTM Multi-class 22.8 0.07
In addition to classification performance, prediction time is DNN Multi-class 20.5489 0.0690
a critical consideration for real-world deployment, particularly
RF Multi-class 5.0694 0.0128
in systems requiring real-time or near-real-time responses. Table
IX presents both the total and average prediction times (per KNN Multi-class 39.0577 0.0983
1,000 records) for each model across binary and multi-class XGBoost Multi-class 26.7887 0.0449
classification tasks, providing insight into their computational
efficiency.

452 | P a g e
[Link]
 (IJACSA) International Journal of Advanced Computer Science and Applications,
Vol. 16, No. 8, 2025

Random Forest exhibited the fastest prediction times in both and accuracy exceeding 99% in binary classification. These
binary and multi-class tasks, making it highly suitable for real- models also maintained robustness in multi-class scenarios,
time applications. Random Forest also demonstrated strong achieving macro F1-scores of up to 0.71.
efficiency, whereas deep learning models, particularly LSTM
and KNN, had the longest processing times. In contrast, the recent work by Samantaray et al. [9], which
employed traditional ML algorithms on the same dataset,
V. DISCUSSION reported significantly lower macro F1-scores—only 0.26 with
Logistic Regression and 0.17 with Random Forest—despite
This study presents a comprehensive evaluation of multiple using MaxAbsScaler for feature scaling. Although their
machine learning (ML) and deep learning (DL) classifiers for approach achieved relatively high overall accuracy (up to 94%)
both binary and multi-class network intrusion detection using in multi-class classification, the low macro-averaged metrics
the NF-UNSW-NB15 dataset. The results demonstrate that the reflect poor generalization across minority classes, indicating
proposed models—particularly XGBoost and Random Forest—
that class imbalance was not sufficiently addressed.
achieved superior performance, with macro-averaged F1-scores

TABLE X. COMPARATIVE RESULTS OF BEST CLASSIFIERS ACROSS STUDIES

Study Model Dataset Type Accuracy Macro Precision Macro Recall Macro F1-Score
This Work RF NF-UNSW-NB15-v2 Binary 0.99 0.95 0.99 0.97
This Work XGBoost NF-UNSW-NB15-v2 Multi-class 0.99 0.73 0.80 0.71
Kasongo and Sun [4] XGBoost NF-UNSW-NB15 Binary 0.91 0.80 0.98 0.88
Samantaray et al. [9] RF NF-UNSW-NB15 Multi-class 0.90 0.23 0.20 0.17
Samantaray et al. [9] KNN NF-UNSW-NB15 Multi-class 0.93 0.29 0.31 0.26
Sayed et al. [10] IoTCNN NF-UNSW-NB15-v2 Multi-class ~0.99 ~0.42 ~0.63 ~0.44
Sharma et al. [33] RF UNSW‑NB15 Binary 0.87 0.90 0.86 0.86

Similarly, the CNN-based models proposed by Sayed et al. on the “NF-UNSW-NB15-v2” dataset. The experiments
[10], namely IoTCNN and MyCNN, demonstrated limited covered both binary (normal vs attack) and nine-class attack
macro-level performance. For example, the IoTCNN model identification tasks, using a unified hyper-parameter budget to
produced low precision and F1-scores in most attack categories, ensure fair comparison.
including F1 = 0.14 for Analysis and 0.13 for DoS, despite
exhibiting high overall accuracy. These results suggest that Results underscore the strength of ensemble trees for tabular
while convolutional models may effectively capture local network-flow data: XGBoost and Random Forest achieved high
patterns, they often struggle with inter-class variance and metrics (≈ 0.9960 for accuracy, precision, recall, F1, and AUC)
generalization without advanced preprocessing or data in binary detection, while XGBoost retained a competitive
augmentation strategies. macro F1-score (0.71) and a balanced confusion matrix in multi-
class testing. Deep models matched overall accuracy but lagged
In addition to Samantaray et al. [9] and Sayed et al. [10], we in macro scores, indicating residual sensitivity to minority
include the study by Sharma et al. [33], which evaluates classes. Crucially,RF and XGBoost’s inference latency—on the
ensemble methods on UNSW-NB15 using a binary setting. order of milliseconds per thousand flows—demonstrates that
Their best model (Random Forest) achieves Accuracy = 0.87, top-tier accuracy can coexist with real-time throughput, making
Macro Precision = 0.90, Macro Recall = 0.86, and Macro the approach deployable in production networks.
F1 = 0.86, whereas our binary IDS on NF-UNSW-NB15-v2
attains Accuracy ≈ 0.99 and Macro F1 ≈ 0.97. Thus, our Although the pipeline raises the state of the art for this
approach improves binary macro-level performance by ≈ 11 dataset, two limitations remain: extremely rare classes such as
points in F1 while also raising accuracy by ≈ 12 percentage Worms and Analysis still risk misclassification despite SMOTE,
points, reinforcing that the proposed SMOTE + PCA + diverse and features were restricted to NetFlow attributes. Future work
should explore cost-sensitive or generative resampling, integrate
ML/DL pipeline generalizes better under class imbalance than
strong ensemble baselines. payload-level and temporal-correlation features, and test hybrid
architectures (e.g., LSTM embeddings feeding XGBoost) under
Overall, our findings highlight the effectiveness of ensemble online-learning and edge-deployment constraints. Overall, the
models—such as XGBoost and Random Forest—in capturing study provides a reproducible blueprint and a strong baseline for
complex feature relationships and addressing class imbalance. A practitioners seeking accurate, low-latency, and resource-
comparative summary of results is provided in Table X. efficient intrusion detection in modern networked environments.
VI. CONCLUSION ACKNOWLEDGMENT
This work developed and empirically validated an end-to- The authors extend their appreciation to the Deanship of
end intrusion-detection pipeline that couples rigorous Research and Graduate Studies at King Khalid University for
preprocessing (StandardScaler normalization, SMOTE funding this work through Large Research Project under grant
oversampling, and PCA dimensionality reduction) with five number RGP2/318/46.
classifiers (XGBoost, RF, KNN, DNN, and LSTM) evaluated

453 | P a g e
[Link]
 (IJACSA) International Journal of Advanced Computer Science and Applications,
Vol. 16, No. 8, 2025

REFERENCES [16] S. Zhang, Z. Shen, and H. Yang, “Deep Network Approximation:

Achieving Arbitrary Accuracy with Fixed Number of Neurons,” Journal
[1] L. Cadieux, "20 Shocking Cybercrime Statistics: 2024 Edition," The of Machine Learning Research, vol. 23, no. 276, pp. 1–60, 2022.
Devolutions Blog, 4 July 2024. [Online]. Available:
[Link] [17] J. Brownlee, "A Gentle Introduction to the Rectified Linear Unit (ReLU),"
2024-edition/?utm_source=[Link]. [Accessed 1 Mars 2025]. Machine Learning Mastery, 20 August 2020. [Online]. Available:
[Link]
[2] M. Sweney, "BT identifying 2,000 signals a second indicating possible for-deep-learning-neural-networks/. [Accessed 1 March 2025].
cyber-attacks," The Guardian, 12 September 2024. [Online]. Available:
[18] F. Huang, X. Li, C. Yuan, S. Zhang, J. Zhang and S. Qiao, "Attention-
[Link]
Emotion-Enhanced Convolutional LSTM for Sentiment Analysis," IEEE
weaponising-ai-for-cybercrime-bt-warns?utm_source=[Link].
[Accessed 1 Mars 2025]. Transactions on Neural Networks and Learning Systems, vol. 33, no. 9,
pp. 1-14, 2021.
[3] O. Ogundairo and P. Broklyn, "Machine Learning Algorithms for
Intrusion Detection Systems," Journal of Cyber Security, 2024. [19] "Machine Learning-Based NIDS Datasets," The University of
Queensland, [Online]. Available:
[4] S. Kasongo and Y. Sun, "Performance analysis of intrusion detection [Link] [Accessed 1
systems using a feature selection method on the UNSW-NB15 dataset," March 2025].
Journal of Big Data, vol. 7, no. 1, p. 105, 2020.
[20] M. Sarhan, S. Layeghy and M. Portmann, "Towards a Standard Feature
[5] V. Kumar, D. Sinha, A. Das, D. S. Pandey and R. Goswami, "An Set for Network Intrusion Detection System Datasets," arXiv, 2021.
integrated rule based intrusion detection system: analysis on UNSW-
NB15 data set and the real time online dataset," Cluster Computing, vol. [21] Nour Moustafa and Jill Slay, "UNSW-NB15: A comprehensive data set
23, 2020. for network intrusion detection systems," Military Communications and
Information Systems Conference (MilCIS), 2015.
[6] S. More and R. Kalkundri, "Evaluation of deceptive mails using filtering
& WEKA," in 2015 International Conference on Innovations in [22] M. Hopkins, E. Reeber, G. Forman, and J. Suermondt, Spambase Dataset,
Information,Embedded and Communication Systems (ICIIECS), 2015. UCI Machine Learning Repository, 1999.
[7] R. Tahri, Y. Balouki, A. Jarrar and L. Abdellatif, "Intrusion Detection [23] I. Androutsopoulos et al., "An experimental comparison of naive
System Using machine learning Algorithms," ITM Web of Conferences, Bayesian and keyword-based anti-spam filtering with personal e-mail
vol. 46, 2022. messages," SIGIR Conference, 2000.
[24] B. Klimt and Y. Yang, "The Enron Corpus: A New Dataset for Email
[8] U. S. Musa, M. Chhabra, A. Ali and M. Kaur, "Intrusion Detection System
Classification Research," European Conference on Machine Learning
using Machine Learning Techniques: A Review," in Int. Conf. Smart
(ECML), 2004.
Electron. Commun. (ICOSEC 2020), 2020.
[25] I. Androutsopoulos et al., PU1 and PU2 corpora for spam filtering
[9] M. Samantaray, R. C. Barik and A. K. Biswal, "A comparative assessment
experiments, 2000.
of machine learning algorithms in the IoT-based network intrusion
detection systems," Decision Analytics Journal, vol. 11, p. 100478, 2024. [26] M. Tavallaee, E. Bagheri, W. Lu, and A. Ghorbani, "A detailed analysis
of the KDD CUP 99 data set," IEEE Symposium on CISDA, 2009.
[10] N. Sayed, M. Shoaib, W. Ahmed, S. N. Qasem, A. M. Albarrak and F.
Saeed, "Augmenting IoT Intrusion Detection System Performance Using [27] KDD Cup 1999 Dataset. UCI Machine Learning Repository.
Deep Neural Network," Computers, Materials & Continua, vol. 72, no. 2, [28] J. Song and H. Kim, "Network intrusion detection based on semi-
p. 3511–3534, 2022. supervised learning and clustering," Expert Systems with Applications,
[11] D. Bzdok, M. Krzywinski and N. Altman, "Machine learning: supervised 2013.
methods," Nat. Methods, vol. 15, p. 5–6, 2018. [29] C. Kolias, G. Kambourakis, A. Stavrou, and S. Gritzalis, "Intrusion
[12] S. Uddin, I. Haque and H. Lu, "Comparative performance analysis of K- detection in 802.11 networks," IEEE ICC, 2015.
nearest neighbour (KNN) algorithm and its different variants for disease [30] I. Sharafaldin, A. H. Lashkari, and A. A. Ghorbani, "Toward generating a
prediction," Sci Rep, vol. 12, no. 6256, 2022. new intrusion detection dataset and intrusion traffic characterization,"
[13] S. He, B. Li, H. Peng, J. Xin and E. Zhang, "An Effective Cost-Sensitive ICISSP, 2018.
XGBoost Method for Malicious URLs Detection in Imbalanced Dataset," [31] M. Fernandez, J. Garcia, A. Sanz, and J. E. Diaz-Verdejo, "UGR'16: A
IEEE Access, vol. 9, pp. 93089-93096, 2021. new dataset for evaluation of IDSs," Computer Networks, 2018.
[14] T. Chen and C. Guestrin, "XGBoost: A Scalable Tree Boosting System," [32] D., Elreedy, A. F., Atiya, & F., Kamalov, “A theoretical distribution
in 22nd ACM SIGKDD International Conference, 2016. analysis of synthetic minority oversampling technique (SMOTE) for
[15] S. Jukic, M. Saracevic, A. Subasi and J. Kevric, "Comparison of ensemble imbalanced learning,” Machine Learning, 113:4903–4923, 2024.
machine learning methods for automated classification of focal and non- [33] N. Sharma, N. S. Yadav, and S. Sharma, “Classification of UNSW‑NB15
focal epileptic EEG signals," Mathematics, vol. 8, no. 9, p. 1481, 2020. dataset using Exploratory Data Analysis using Ensemble Learning,” EAI
Endorsed Transactions on Industrial Networks and Intelligent Systems,
vol. 8, no. 29, e4, Oct. 2021.

454 | P a g e
[Link]