TOPIC: Deep Learning Approach for Network Intrusion Detection and Multi-Class Attack Classification Using UNSW-NB15 Dataset

Technical Summary: Deep Learning Approach for Network Intrusion Detection and Multi-Class Attack Classification Using UNSW-NB15 Dataset

Problem Statement
The increasing sophistication of cyber threats, including reconnaissance, exploitation, and denial-of-service attacks, has exposed the limitations of traditional signature-based and statistical Intrusion Detection Systems (IDS). These conventional approaches struggle to detect evolving, zero-day, and complex attack patterns due to their reliance on predefined rules. While machine learning and deep learning offer promising alternatives for learning complex nonlinear patterns from high-dimensional network traffic, existing research often lacks systematic comparative evaluations under consistent preprocessing and balancing conditions. Furthermore, intrusion detection datasets frequently exhibit class imbalance, feature heterogeneity, and varying attack distributions, which degrade the classification performance of minority attack categories.

Methodology
This study proposes a comparative deep learning framework utilizing the UNSW-NB15 dataset, a modern benchmark containing 49 features and 10 classes (9 attack categories plus normal traffic). The research implements a rigorous preprocessing pipeline to ensure methodological consistency and prevent data leakage:

1. Data Cleaning: Missing values (represented as hyphens) were converted to NaN, and columns with near-total missingness were removed.
2. Feature Selection: A subset of relevant features (e.g., source/destination ports, protocols, duration, byte counts, packet counts, and DNS attributes) was selected to reduce dimensionality.
3. Partitioning: A stratified 75/25 train-test split was performed to preserve class distribution.
4. Scaling: Standardization (StandardScaler) was applied using parameters derived exclusively from the training set.
5. Balancing: The Synthetic Minority Oversampling Technique (SMOTE) was applied only to the training dataset to address class imbalance, leaving the test set untouched for unbiased evaluation.

Three deep learning architectures were developed and evaluated using TensorFlow and Keras:

• Artificial Neural Network (ANN): A feedforward sequential model with an input layer (12 neurons), two hidden dense layers (8 neurons each), and a SoftMax output layer for 10 classes.
• Convolutional Neural Network (CNN): A 1D convolutional architecture featuring a Conv1D layer (64 filters, kernel size 3), MaxPooling1D, a Flatten layer, and a Dense layer (64 neurons) before the SoftMax output.
• Recurrent Neural Network with Long Short-Term Memory (RNN-LSTM): An architecture reshaping input features into a sequence (N, F, 1) to utilize a single LSTM layer (64 units) followed by a Dense layer (64 neurons) and SoftMax output.

All models were trained using the Adam optimizer (learning rate 0.001) and categorical cross-entropy loss. Performance was evaluated using Accuracy, Precision, Recall, F1-score, ROC-AUC, and Confusion Matrix analysis.

Key Contributions
The paper provides a controlled comparative evaluation of ANN, CNN, and RNN-LSTM architectures under a unified experimental framework. Specific contributions include:

• The implementation of a standardized preprocessing pipeline involving feature cleaning, scaling, stratified splitting, and controlled SMOTE balancing applied strictly to the training data.
• A comprehensive multi-metric evaluation (including ROC-AUC and confusion matrices) across all three architectures.
• An analysis of the trade-offs between classification performance and computational cost (training time) for different deep learning paradigms in the context of multiclass intrusion detection.

Results
Experimental results demonstrated that all three models achieved strong intrusion detection performance, but with distinct variations in accuracy and efficiency:

• RNN-LSTM: Achieved the highest performance with 97.42% accuracy, 97.45% precision, 97.42% recall, and an F1-score of 97.42%. It also recorded the highest ROC-AUC (0.9991). However, it required the longest training time (1,698.24 seconds).
• CNN: Performed as the second-best model with 94.64% accuracy and an F1-score of 94.71%, requiring 491.52 seconds for training.
• ANN: Recorded the lowest performance among the three with 91.58% accuracy and an F1-score of 91.65%, but offered the fastest training time (220.25 seconds).

Class-specific analysis revealed that while all models performed well on categories like Backdoor, DoS, and Normal traffic, challenges remained in distinguishing specific minority classes such as MITM (Man-in-the-Middle) and DDoS, which showed some overlap in the confusion matrices.

Significance and Claims
The paper claims that the RNN-LSTM architecture is the most effective among the evaluated models for multiclass intrusion classification on the UNSW-NB15 dataset, attributing this success to its ability to model complex feature dependencies through memory-based learning mechanisms. The study highlights that while deep learning techniques significantly improve detection capabilities over traditional methods, the choice of architecture involves a trade-off between predictive accuracy and computational resources.

The authors conclude that their findings demonstrate the effectiveness of deep learning for network intrusion detection and specifically validate the potential of RNN-LSTM for improving cybersecurity monitoring. The paper modestly suggests that future work should explore the framework on additional datasets, real-time traffic conditions, and emerging architectures such as transformer-based models, federated learning, and explainable AI to further enhance interpretability and deployment scalability.