Intrusion Detection Systems (IDS) play a critical role in safeguarding networks from increasingly sophisticated cyberattacks. This paper presents a comprehensive comparative study of six supervised learning models, which are Random Forest, XGBoost, LightGBM, Support Vector Machine (SVM), Multi-Layer Perceptron (MLPClassifier), and Deep Neural Network (DNN), applied to the KDD Cup 1999 dataset for multi-class intrusion detection. The study evaluates each model’s performance across five attack categories: Normal, DoS, Probe, R2L, and U2R, using standardized preprocessing and a consistent experimental setup. Models are assessed using accuracy, precision, recall, F1-score, and ROC-AUC, with a focus on macro-averaged metrics due to the dataset’s class imbalance. Results show that XGBoost achieved the highest overall performance, with strong precision and superior detection of minority attack types, followed closely by Random Forest and LightGBM. In contrast, SVM exhibited the weakest recall and F1-score, particularly for rare classes. This benchmark highlights the effectiveness of tree-based ensemble methods in intrusion detection and offers insights into the trade-offs between accuracy, interpretability, and inference efficiency.

错误:搜索内容不能为空,请输入英文关键词
错误:关键词超出字数限制,请精简
高级检索

Revisiting Intrusion Detection: A Comparative Benchmark of Supervised Learning Models on the KDD Cup 1999 Dataset

  • Phuc-Hung Pham Le,
  • Hong-Nhung Nguyen Thi,
  • Trung-Hieu Huynh Nhat,
  • Huy-Minh Doan Xuan

摘要

Intrusion Detection Systems (IDS) play a critical role in safeguarding networks from increasingly sophisticated cyberattacks. This paper presents a comprehensive comparative study of six supervised learning models, which are Random Forest, XGBoost, LightGBM, Support Vector Machine (SVM), Multi-Layer Perceptron (MLPClassifier), and Deep Neural Network (DNN), applied to the KDD Cup 1999 dataset for multi-class intrusion detection. The study evaluates each model’s performance across five attack categories: Normal, DoS, Probe, R2L, and U2R, using standardized preprocessing and a consistent experimental setup. Models are assessed using accuracy, precision, recall, F1-score, and ROC-AUC, with a focus on macro-averaged metrics due to the dataset’s class imbalance. Results show that XGBoost achieved the highest overall performance, with strong precision and superior detection of minority attack types, followed closely by Random Forest and LightGBM. In contrast, SVM exhibited the weakest recall and F1-score, particularly for rare classes. This benchmark highlights the effectiveness of tree-based ensemble methods in intrusion detection and offers insights into the trade-offs between accuracy, interpretability, and inference efficiency.