{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,8]],"date-time":"2026-07-08T13:30:09Z","timestamp":1783517409275,"version":"3.55.0"},"reference-count":33,"publisher":"MDPI AG","issue":"10","license":[{"start":{"date-parts":[[2020,9,30]],"date-time":"2020-09-30T00:00:00Z","timestamp":1601424000000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"DOI":"10.13039\/100004351","name":"Cisco Systems","doi-asserted-by":"publisher","award":["No number assigned"],"award-info":[{"award-number":["No number assigned"]}],"id":[{"id":"10.13039\/100004351","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Future Internet"],"abstract":"<jats:p>The development of robust anomaly-based network detection systems, which are preferred over static signal-based network intrusion, is vital for cybersecurity. The development of a flexible and dynamic security system is required to tackle the new attacks. Current intrusion detection systems (IDSs) suffer to attain both the high detection rate and low false alarm rate. To address this issue, in this paper, we propose an IDS using different machine learning (ML) and deep learning (DL) models. This paper presents a comparative analysis of different ML models and DL models on Coburg intrusion detection datasets (CIDDSs). First, we compare different ML- and DL-based models on the CIDDS dataset. Second, we propose an ensemble model that combines the best ML and DL models to achieve high-performance metrics. Finally, we benchmarked our best models with the CIC-IDS2017 dataset and compared them with state-of-the-art models. While the popular IDS datasets like KDD99 and NSL-KDD fail to represent the recent attacks and suffer from network biases, CIDDS, used in this research, encompasses labeled flow-based data in a simulated office environment with both updated attacks and normal usage. Furthermore, both accuracy and interpretability must be considered while implementing AI models. Both ML and DL models achieved an accuracy of 99% on the CIDDS dataset with a high detection rate, low false alarm rate, and relatively low training costs. Feature importance was also studied using the Classification and regression tree (CART) model. Our models performed well in 10-fold cross-validation and independent testing. CART and convolutional neural network (CNN) with embedding achieved slightly better performance on the CIC-IDS2017 dataset compared to previous models. Together, these results suggest that both ML and DL methods are robust and complementary techniques as an effective network intrusion detection system.<\/jats:p>","DOI":"10.3390\/fi12100167","type":"journal-article","created":{"date-parts":[[2020,9,30]],"date-time":"2020-09-30T09:41:01Z","timestamp":1601458861000},"page":"167","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":94,"title":["Comparison of Machine Learning and Deep Learning Models for Network Intrusion Detection Systems"],"prefix":"10.3390","volume":"12","author":[{"ORCID":"https:\/\/orcid.org\/0000-0003-2533-7462","authenticated-orcid":false,"given":"Niraj","family":"Thapa","sequence":"first","affiliation":[{"name":"Department of Computational Data Science and Engineering, North Carolina A&amp;T State University, Greensboro, NC 27411, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Zhipeng","family":"Liu","sequence":"additional","affiliation":[{"name":"Department of Computer Science, North Carolina A&amp;T State University, Greensboro, NC 27411, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Dukka B.","family":"KC","sequence":"additional","affiliation":[{"name":"Electrical Engineering and Computer Science Department, Wichita State University, Wichita, KS 67260, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Balakrishna","family":"Gokaraju","sequence":"additional","affiliation":[{"name":"Department of Computational Data Science and Engineering, North Carolina A&amp;T State University, Greensboro, NC 27411, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Kaushik","family":"Roy","sequence":"additional","affiliation":[{"name":"Department of Computer Science, North Carolina A&amp;T State University, Greensboro, NC 27411, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"1968","published-online":{"date-parts":[[2020,9,30]]},"reference":[{"key":"ref_1","doi-asserted-by":"crossref","unstructured":"Hussain, A., and Sharma, P. (2019). Efficient Working of Signature Based Intrusion Detection Technique in Computer Networks. Int. J. Sci. Res. Comput. Sci. Eng. Inf. Technol., 60\u201364.","DOI":"10.32628\/CSEIT195215"},{"key":"ref_2","unstructured":"Guo, C., Gardner, J.R., You, Y., Wilson, A.G., and Weinberger, K.Q. (2019). Simple Black-box Adversarial Attacks. arXiv."},{"key":"ref_3","unstructured":"Nazemi, A., and Fieguth, P. (2019). Potential adversarial samples for white-box attacks. arXiv."},{"key":"ref_4","first-page":"40","article-title":"Creation of Flow-Based Data Sets for Intrusion Detection","volume":"16","author":"Ring","year":"2017","journal-title":"J. Inf. Warf."},{"key":"ref_5","unstructured":"Ring, M., Wunderlich, S., Gr\u00fcdl, D., Landes, D., and Hotho, A. (2017, January 29\u201330). Flow-based benchmark data sets for intrusion detection. Proceedings of the 16th European Conference on Cyber Warfare and Security (ECCWS), Dublin, Ireland."},{"key":"ref_6","doi-asserted-by":"crossref","unstructured":"Sharafaldin, I., Habibi Lashkari, A., and Ghorbani, A. (2018, January 22\u201324). Toward Generating a New Intrusion Detection Dataset and Intrusion Traffic Characterization. Proceedings of the International Conference on Information Systems Security and Privacy, Madeara, Portugal.","DOI":"10.5220\/0006639801080116"},{"key":"ref_7","unstructured":"(2020, September 30). KDD Cup 1999 Data. Available online: http:\/\/kdd.ics.uci.edu\/databases\/kddcup99\/kddcup99.html."},{"key":"ref_8","doi-asserted-by":"crossref","unstructured":"Tavallaee, M., Bagheri, E., Lu, W., and Ghorbani, A.A. (2009, January 8\u201310). A detailed analysis of the KDD CUP 99 data set. Proceedings of the 2009 IEEE Symposium on Computational Intelligence for Security and Defense Applications, Ottawa, ON, Canada.","DOI":"10.1109\/CISDA.2009.5356528"},{"key":"ref_9","doi-asserted-by":"crossref","unstructured":"Cunningham, R.K., Lippmann, R.P., Fried, D.J., Garfinkel, S.L., Graf, I., Kendall, K.R., Webster, S.E., Wyschogrod, D., and Zissman, M.A. (1999). Evaluating Intrusion Detection Systems without Attacking Your Friends: The 1998 Darpa Intrusion Detection Evaluation, Massachusetts Inst Of Tech Lexington Lincoln Lab.","DOI":"10.21236\/ADA526274"},{"key":"ref_10","doi-asserted-by":"crossref","unstructured":"Obeidat, I., Hamadneh, N., Al-kasassbeh, M., and Almseidin, M. (2018). Intensive Preprocessing of KDD Cup 99 for Network Intrusion Classification Using Machine Learning Techniques. arXiv.","DOI":"10.3991\/ijim.v13i01.9679"},{"key":"ref_11","doi-asserted-by":"crossref","first-page":"48","DOI":"10.1049\/iet-ifs.2018.5258","article-title":"Network intrusion detection algorithm based on deep neural network","volume":"13","author":"Jia","year":"2019","journal-title":"IET Inf. Secur."},{"key":"ref_12","doi-asserted-by":"crossref","unstructured":"Chowdhury, M.M.U., Hammond, F., Konowicz, G., Xin, C., Wu, H., and Li, J. (2017, January 19\u201321). A few-shot deep learning approach for improved intrusion detection. Proceedings of the 2017 IEEE 8th Annual Ubiquitous Computing, Electronics and Mobile Communication Conference (UEMCON), New York, NY, USA.","DOI":"10.1109\/UEMCON.2017.8249084"},{"key":"ref_13","first-page":"1848","article-title":"A Detailed Analysis on NSL-KDD Dataset Using Various Machine Learning Techniques for Intrusion Detection","volume":"2","author":"Revathi","year":"2013","journal-title":"Int. J. Eng. Res. Technol."},{"key":"ref_14","doi-asserted-by":"crossref","unstructured":"Kirsal-Ever, Y., Sekeroglu, B., and Dimililer, K. (2019, January 26\u201328). Classification Analysis of Intrusion Detection on NSL-KDD Using Machine Learning Algorithms. Proceedings of the International Conference on Mobile Web and Intelligent Information Systems, Cham, Switzerland.","DOI":"10.1007\/978-3-030-27192-3_9"},{"key":"ref_15","doi-asserted-by":"crossref","first-page":"29575","DOI":"10.1109\/ACCESS.2020.2972627","article-title":"BAT: Deep Learning Methods on Network Intrusion Detection Using NSL-KDD Dataset","volume":"8","author":"Su","year":"2020","journal-title":"IEEE Access"},{"key":"ref_16","doi-asserted-by":"crossref","unstructured":"Zhang, C., Ruan, F., Yin, L., Chen, X., Zhai, L., and Liu, F. (2019, January 25\u201327). A Deep Learning Approach for Network Intrusion Detection Based on NSL-KDD Dataset. Proceedings of the 2019 IEEE 13th International Conference on Anti-counterfeiting, Security, and Identification (ASID), Xiamen, China,.","DOI":"10.1109\/ICASID.2019.8925239"},{"key":"ref_17","doi-asserted-by":"crossref","first-page":"343","DOI":"10.1109\/SURV.2010.032210.00054","article-title":"An Overview of IP Flow-Based Intrusion Detection","volume":"12","author":"Sperotto","year":"2010","journal-title":"IEEE Commun. Surv. Tutor."},{"key":"ref_18","doi-asserted-by":"crossref","first-page":"357","DOI":"10.1016\/j.cose.2011.12.012","article-title":"Toward developing a systematic approach to generate benchmark datasets for intrusion detection","volume":"31","author":"Shiravi","year":"2012","journal-title":"Comput. Secur."},{"key":"ref_19","doi-asserted-by":"crossref","first-page":"2037","DOI":"10.1109\/COMST.2014.2321898","article-title":"Flow Monitoring Explained: From Packet Capture to Data Analysis With NetFlow and IPFIX","volume":"16","author":"Hofstede","year":"2014","journal-title":"IEEE Commun. Surv. Tutor."},{"key":"ref_20","doi-asserted-by":"crossref","first-page":"709","DOI":"10.1016\/j.procs.2017.12.091","article-title":"Statistical analysis of CIDDS-001 dataset for Network Intrusion Detection Systems using Distance-based Machine Learning","volume":"125","author":"Verma","year":"2018","journal-title":"Procedia Comput. Sci."},{"key":"ref_21","doi-asserted-by":"crossref","first-page":"21","DOI":"10.1109\/TIT.1967.1053964","article-title":"Nearest neighbor pattern classification","volume":"13","author":"Cover","year":"1967","journal-title":"IEEE Trans. Inf. Theory"},{"key":"ref_22","doi-asserted-by":"crossref","unstructured":"Chen, T., and Guestrin, C. (2016). XGBoost: A Scalable Tree Boosting System. arXiv.","DOI":"10.1145\/2939672.2939785"},{"key":"ref_23","unstructured":"Breiman, L., Friedman, J.H., Olshen, R.A., and Stone, C.J. (1984). Classification and Regression Trees, Wadsworth & Brooks\/Cole Advanced Books & Software."},{"key":"ref_24","doi-asserted-by":"crossref","first-page":"2","DOI":"10.21037\/atm.2016.05.14","article-title":"Decision tree modeling using R","volume":"4","author":"Zhang","year":"2016","journal-title":"Ann. Transl. Med."},{"key":"ref_25","doi-asserted-by":"crossref","first-page":"436","DOI":"10.1038\/nature14539","article-title":"Deep learning","volume":"521","author":"LeCun","year":"2015","journal-title":"Nature"},{"key":"ref_26","doi-asserted-by":"crossref","first-page":"1735","DOI":"10.1162\/neco.1997.9.8.1735","article-title":"Long Short-term Memory","volume":"9","author":"Hochreiter","year":"1997","journal-title":"Neural Comput."},{"key":"ref_27","first-page":"1137","article-title":"A Neural Probabilistic Language Model","volume":"3","author":"Bengio","year":"2003","journal-title":"J. Mach. Learn. Res."},{"key":"ref_28","doi-asserted-by":"crossref","unstructured":"Thapa, N., Chaudhari, M., McManus, S., Roy, K., Newman, R., Saigo, H., and Kc, D. (2020). DeepSuccinylSite: A deep learning based approach for protein succinylation site prediction. BMC Bioinform., 21.","DOI":"10.1186\/s12859-020-3342-z"},{"key":"ref_29","unstructured":"Kingma, D.P., and Ba, J. (2014). Adam: A Method for Stochastic Optimization. arXiv."},{"key":"ref_30","doi-asserted-by":"crossref","unstructured":"Zhang, C., and Ma, Y. (2012). Ensemble Machine Learning: Methods and Applications, Springer Publishing Company; Incorporated.","DOI":"10.1007\/978-1-4419-9326-7"},{"key":"ref_31","first-page":"187","article-title":"Evaluating the CIC IDS-2017 Dataset Using Machine Learning Methods and Creating Multiple Predictive Models in the Statistical Computing Language R","volume":"5","author":"Pelletier","year":"2020","journal-title":"Science"},{"key":"ref_32","doi-asserted-by":"crossref","first-page":"587","DOI":"10.1109\/TNN.2005.844858","article-title":"Mutation-based genetic neural network","volume":"16","author":"Palmes","year":"2005","journal-title":"IEEE Trans. Neural Netw."},{"key":"ref_33","unstructured":"Goodfellow, I.J., Pouget-Abadie, J., Mirza, M., Xu, B., Warde-Farley, D., Ozair, S., Courville, A., and Bengio, Y. (2014). Generative Adversarial Networks. arXiv."}],"container-title":["Future Internet"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/1999-5903\/12\/10\/167\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,11]],"date-time":"2025-10-11T10:15:05Z","timestamp":1760177705000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/1999-5903\/12\/10\/167"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2020,9,30]]},"references-count":33,"journal-issue":{"issue":"10","published-online":{"date-parts":[[2020,10]]}},"alternative-id":["fi12100167"],"URL":"https:\/\/doi.org\/10.3390\/fi12100167","relation":{},"ISSN":["1999-5903"],"issn-type":[{"value":"1999-5903","type":"electronic"}],"subject":[],"published":{"date-parts":[[2020,9,30]]}}}