Deep Learning vs Machine Learning for Intrusion Detection in Computer Networks

When we talk about securing modern networks, intrusion detection systems (IDS) are the front line. Traditionally, these systems relied on rules or signatures, essentially looking for known attack “fingerprints.” In recent years, machine learning (ML) and deep learning (DL) have stepped in as more adaptive solutions, able to generalize from patterns rather than hand-crafted signatures.

A new paper, “Deep Learning vs. Machine Learning for Intrusion Detection in Computer Networks: A Comparative Study” , puts these approaches head-to-head on one of the most widely used benchmarks (CICIDS2017). The authors evaluate everything from logistic regression to LSTMs and CNNs, paying special attention to class imbalance, feature engineering, and computational costs.

The results are not as one-sided as you might think, and they offer concrete guidance for anyone designing IDS today.

Why This Study Matters

The volume of network traffic keeps growing, and cyberattacks keep evolving. Signature-based IDS can’t keep up with zero-days or sophisticated evasion tactics, and ML/DL promise to fill that gap. But “ML” and “DL” aren’t monolithic.

The authors compare:

• Traditional ML models: logistic regression, naive Bayes, random forest, decision tree, K-nearest neighbors (KNN), and SVM.
• Deep learning models: multilayer perceptron (MLP), convolutional neural network (CNN), and long short-term memory (LSTM).

They also address two pain points that plague IDS research:

1. Class imbalance: Some attacks are rare but critical. They use SMOTE (Synthetic Minority Over-Sampling Technique) to generate synthetic examples of underrepresented attacks like “Web Attacks.”
2. Feature engineering: For ML models they apply correlation-based feature selection to prune redundant features. DL models, by contrast, learn features directly from raw data.

A Quick Primer on the Models

• Random Forest & Decision Trees: Ensemble and tree-based methods that handle non-linear decision boundaries well. They’re relatively interpretable.
• KNN & SVM: Distance and margin-based classifiers, strong in balanced datasets but sensitive to scaling.
• MLP: A “vanilla” neural network, effective for tabular data.
• CNN: Learns spatial patterns in data (often used for images), here repurposed for feature-rich network data.
• LSTM: A recurrent architecture tuned to temporal dependencies, ideal for sequential traffic analysis.

The Dataset: CICIDS2017

The study used the CICIDS2017 dataset (2.8 million rows, 79 features), a standard benchmark that mimics realistic traffic. Preprocessing included removing duplicates and infinities, imputing missing values, consolidating labels (grouping similar attacks), stratified sampling, and applying SMOTE for balancing.

After preprocessing, the authors standardized features and trained the models, using random search for hyperparameter tuning.

Results at a Glance

Machine Learning Models

• Random Forest - 99.88% accuracy, average F1 score 97.46% (best overall).
• Decision Tree - 99.83% accuracy, F1 97.60%.
• KNN - 99.36% accuracy, F1 97.62%.
• Logistic Regression - 96.91% accuracy, F1 74% (struggled on minority attacks).
• Naive Bayes - 64.59% accuracy, F1 48.88%.
• SVM - 97.32% accuracy, F1 73.33%.

Random forest handled both the majority and minority classes well, including “Web Attacks,” where others failed.

Deep Learning Models

• MLP - 97% accuracy, macro F1 82%.
• CNN - 98% accuracy, macro F1 83%.
• LSTM - 98% accuracy, macro F1 84% (best among DL).

All three deep learning models performed strongly, especially on major classes, but still struggled somewhat on the rarest attack types.

What’s Surprising Here?

Two takeaways stood out:

1. Random Forest still rules: Even with all the hype around deep learning, a well-tuned random forest beat CNNs and LSTMs in raw accuracy and F1. For structured, tabular data with engineered features, tree ensembles remain hard to beat.
2. LSTM excels at balance: Among DL models, LSTM had the highest macro F1, hinting at its ability to capture temporal dependencies in network traffic.

Beyond Accuracy: Scalability and Efficiency

The authors didn’t stop at accuracy. They discussed the trade-offs between performance and computational cost:

• Deep learning models (especially LSTM and CNN) require more resources, which may hinder real-time deployment in constrained environments.
• Techniques like parallel processing, distributed training, and model compression (pruning, quantization, knowledge distillation) can mitigate this but add engineering complexity.
• Tree-based models like random forest are simpler to deploy and explain but may not scale as gracefully to raw, unprocessed data streams.

Practical Lessons for IDS Designers

If you’re building or selecting an intrusion detection system:

• For highest accuracy on structured data: Start with random forest or decision trees.
• For time-sequence analysis: LSTM may pay off, especially if you can invest in hardware and optimization.
• Balance your data: SMOTE or other rebalancing techniques can dramatically improve minority attack detection.
• Prune your features: Correlation-based selection can boost ML models and reduce training time.
• Plan for deployment: Resource efficiency matters as much as accuracy when monitoring real networks.

Where to Go Next

The paper highlights promising directions:

• Hybrid models combining DL feature extraction with ML classifiers (CNN + SVM, LSTM + RF) could yield the best of both worlds.
• Semi-supervised or unsupervised DL might handle unlabeled traffic better.
• Adversarial robustness is an open challenge, how do these models hold up under evasion or poisoning attacks?

Takeaway

This comparative study reminds us that deep learning is not a silver bullet. For network intrusion detection, classic machine learning, especially random forest, still delivers top-tier performance with fewer resources and simpler deployment. Deep learning shines where patterns are highly complex or sequential, but it comes with higher costs.

For practitioners, the choice isn’t binary. The future likely belongs to hybrid systems that leverage the strengths of both approaches, underpinned by robust data preprocessing and class balancing.

What do you think? Would you stick with a tuned random forest for IDS today, or invest in deep learning architectures for future-proofing?

Drop your thoughts in the comments. I’d love to hear how you’d approach designing the next generation of intrusion detection systems.