Aug 2026· IAES International Journal of Artificial Intelligence (IJ-AI)· 0 citations· 26 references
Abstract
This article proposes an advanced method for network intrusion detection using a combination of recurrent neural networks (RNNs), specifically long short-term memory (LSTM), gated recurrent units (GRU), and bidirectional long short-term memory (BiLSTM) models, enhanced by synthetic minority oversampling technique (SMOTE) to address class imbalance in datasets like network security laboratory–knowledge discovery in databases (NSL-KDD). The method aims to accurately classify network traffic by learning temporal patterns of both normal and malicious activities. SMOTE is employed to balance the dataset, ensuring that underrepresented attack types receive adequate model attention, thereby improving model robustness. The proposed models (LSTM, GRU, and BiLSTM) are trained and evaluated on the NSL-KDD dataset, with hyperparameter tuning performed through RandomizedSearchCV for optimal performance. The results show a significant improvement in accuracy, precision, recall, and F1-score, with BiLSTM demonstrating the highest performance, achieving near-perfect classification results (99.5% accuracy). This method not only mitigates the issue of class imbalance but also leverages the power of RNNs for sequence modeling, offering a promising solution for effective intrusion detection in modern networks.
The findings indicate that hybrid deep learning techniques can improve network security by enhancing intrusion detection capability while reducing false alarms.
A. O. Jimoh-Mahmud, Abubakar Dayyabu, Abubakar Sadiq Idris et al.· FUDMA Journal of Sciences· 0 citations
HTTP Flood attacks remain difficult to detect because they operate at the application layer, resemble legitimate user requests, and generate burst-based temporal traffic patterns. Previous DDoS detection studies often rely on outdated datasets, process network flows as independent records, insufficiently address class imbalance, and provide limited interpretability for security analysts. This study proposes a sequence-aware and explainable deep learning framework for HTTP Flood detection using Long Short-Term Memory (LSTM). Reconstructed HTTP traffic from the UNSW-NB15 dataset was processed through proxy labeling, data cleaning, feature normalization, and sliding-window transformation to convert flow-level records into temporal sequences. Class weighting and SMOTE oversampling were evaluated to mitigate imbalance, while SHAP and LIME were used to explain model decisions. The proposed LSTM model achieved an attack recall of 94.8%, a false negative rate of 5.2%, balanced accuracy of 94.3%, MCC of 0.824, and ROC-AUC of 0.975. The results show that temporal representation improves detection of bursty HTTP Flood behavior, whereas class weighting provides a better balance between attack sensitivity and false-alarm control. Explainability analysis further confirms that the model relies on technically meaningful indicators, including packet rate, flow duration, traffic asymmetry, and service concentration. This framework supports interpretable early-warning detection for application-layer DDoS attacks.
Abstract – To identify anomalies in network traffic patterns through the NSL-KDD datasets, this study created and tested six deep models: Recurrent Neural Networks (RNN), Long Short-Term Memory (LSTM), Gated Recurrent Units (GRU), Convolutional Neural Networks (CNN), Bidirectional Long Short-Term Memory (BiLSTM), and Transformer. The main aim was to evaluate the performance of these models to detect network anomalies as this is critical in providing the security and integrity of autonomous network systems. The data preprocessing phase comprised of normalization, splitting of data, and dimensionality reduction using Principal Component Analysis (PCA). All models were trained and tested using high-performance metrics like accuracy, precision, recall, and F1-score with libraries like TensorFlow, Pandas, Matplotlib, NumPy, and Scikit-learnand. According to the results, BiLSTM performed better. The findings showed that: BiLSTM performed better than other models with precision and recall rates of 98.43% and 98.13%, respectively. GRU was second with 95.51% accuracy, followed by LSTM (94.15%) and CNN (92.78%). Surprisingly, the Transformer model performed very poorly with 6.00% accuracy. These findings resonate with previous studies conducted by Imran et al., who used BiLSTM and achieved 91.36% accuracy, and Li et al., who achieved 82.87% accuracy using GRU on NSL-KDD. This work is a useful study on using deep learning models for network security and verifies the performance of the BiLSTM model for anomaly detection. The future work will explore further improvement of model performance and adjustment to new network threats.
C. Ugwunna, Joshua John, Abayomi-Alli Ayomide et al.· Journal of Independent Studi...· 0 citations
This study examines a one-dimensional Convolutional Neural Network and a hybrid model, investigating how both architectures can detect network attacks in binary and multiclass classification settings, and provides actionable insights for practitioners choosing between deep learning and classical approaches under real-world NIDS deployment constraints.
An OFLN by addition of PSO to perform automated hyperparameter optimization and MAML to enable high-speed adaptation to new and previously seen attacks is proposed, which is more effective than baseline ensemble models in detection accuracy, resistance to class imbalance and training efficiency.
An Enhanced Multi-Model Ensemble Network Intrusion Detection System (EME-NIDS), a deep meta-learning system that combines five different heterogeneous learning paradigms, including Convolutional Neural Networks, Dense Neural Networks, Transformers, XGBoost, and Random Forests is introduced.
