Benign-Only Training for Network Intrusion Detection: A Comparative Study of Isolation Forest, One-Class SVM, and Autoencoders

Abstract

Network intrusion detection remains an important task in communication and information security, especially in scenarios where previously unseen or weakly represented attacks may not be captured by signature-based methods. This paper presents a comparative evaluation of three unsupervised anomaly detection models, namely Isolation Forest, One-Class SVM, and Autoencoder, for network intrusion detection using the CSE-CIC-IDS2018 dataset. The experimental pipeline employs benign-only training, unified preprocessing, validation-based threshold selection, and evaluation using accuracy, precision, recall, F1-score, ROC-AUC, and runtime. Under the common 60k-sample setting, the Autoencoder achieved the best overall performance with an F1-score of 0.6698 and ROC-AUC of 0.7707, outperforming Isolation Forest and One-Class SVM. Additional scaling and tuning experiments further improved the Autoencoder to an F1-score of 0.7586 and ROC-AUC of 0.8607 on a 120k-sample setup. The results show that the Autoencoder provides the most balanced detection quality, while One-Class SVM suffers from excessive false positives and Isolation Forest offers only moderate performance.