# Anomaly-based intrusion detection on benchmark datasets for network security: a comprehensive evaluation

## TL;DR

This paper evaluates DNN and RNN models for detecting network intrusions using benchmark datasets, finding that both models perform well with high accuracy and low false positives.

## Contribution

A comprehensive evaluation of DNN and RNN models using multiple optimizers and benchmark datasets for intrusion detection.

## Key findings

- DNN and RNN models achieve over 99% accuracy on KDDCup99 and NSL-KDD datasets.
- Adam optimizer consistently provides the best performance across all models.
- False positive rates remain under 8% on the more complex UNSW-NB15 dataset.

## Abstract

This study discusses two widely-recognized deep learning approaches for network intrusion detection: a Deep Neural Network (DNN) and a Recurrent Neural Network (RNN). Both models are trained and evaluated on three widely used benchmark datasets: KDDCup99, NSL-KDD (each with five classes), and UNSW-NB15 (ten classes). Multiple optimizers, including Adam, SGD, Adamax, AdamW, and Adadelta, are then explored, with Adam consistently providing the best performance. CrossEntropyLoss is found to be the most effective loss function for these multi-class classification tasks. Designed to automatically learn and extract relevant features from raw data, the models reduce reliance on manual feature engineering. Performance is assessed using accuracy, precision, recall, F1-score, and false positive rate. Experimental results show that both models achieve over 99% accuracy on KDDCup99, with improved detection rates and false positive rates below 1% for KDDCup99 and NSL-KDD. On the more complex UNSW-NB15 dataset, false positive rates also remain under 8%, demonstrating the models’ robustness and generalizability across diverse intrusion scenarios.