Machine and deep learning classifiers for binary and multi-class network intrusion detection systems - Aloqaily, Ahmad; Abdallah, Emad Eddien; Abu Elsoud, Esraa; Hamdan, Yazan; Jallad, Khaled (Institute of Advanced Engineering and Science, 2025)
The rapid proliferation of the internet and advancements in communication technologies have significantly improved networking and increased data vol ume. This phenomenon has subsequently caused a multitude of novel attacks, thereby presenting significant challenges for network security in the intrusion detection system (IDS). Moreover, the ongoing threat from authorized entities who try to carry out various types of attacks on the network is a concern that must be handled seriously. IDS are used to provide network availability, confidentiality, and integrity by employing machine learning (ML) and deep learning (DL) algorithms. This research aimed to study the impacts of the binary and multi-attack instances label by establishing IDS that leverages hybrid algorithms, including artificial neural networks (ANN), random forest (RF), and logistic model trees (LMTs). The paper addresses challenges such as data pre processing, feature selection, and managing imbalanced datasets by applying synthetic minority oversampling technique (SMOTE) and Pearson’s correlation methodologies. The IDS was tested using network security laboratory knowledge discovery datasets (NSL-KDD) and catalonia independence corpus intrusion detection system (CIC-IDS-2017) datasets, achieving an average F1-score of 96% for binary classification on NSL-KDD and 85% for binary classification on CIC-IDS-2017, while for multi-classification, the proposed model achieved an average F1-score of 82% and 96% for NSL-KDD and CIC-IDS-2017 successively.