Comparative Performance Evaluation of Deep Neural Networks and XGBoost for Multi-Class Network Intrusion Detection Using UNSW-NB15 and CIC-BoT-IoT Datasets

Abstract

Network Intrusion Detection Systems (NIDS) have become a key element of contemporary cybersecurity infrastruc-ture as a result of the increasing rate and complexity of cyber attacks. The use of the traditional intrusion detection methods based on signatures is not efficient in the case of the constantly evolving and emerging threats, which motivates the necessity of using machine learning and deep learning techniques for network security. In this paper, the comparative performance analysis of the Deep Neural Network (DNN) and Extreme Gradient Boosting (XGBoost) techniques for multi-class network intrusion detection has been conducted on the basis of the famous UNSW-NB15 and CIC-BoT-IoT-V2 datasets.
The proposed system incorporates various stages of data pre-processing, such as duplication removal, dealing with missing values, encoding of categorical variables, normalization of all features and splitting the dataset into train and test parts using stratification. The architecture of the DNN includes several fully-connected layers with dropout, while the XGBoost technique uses gradient boosted decision trees for multi-class classification.
Performance of the models is evaluated according to accuracy, precision, recall, F1-score, ROC curves, confusion matrices, time required for training, and time required for prediction. The XGBoost classifier demonstrates an overall accuracy of 81.36% on the UNSW-NB15 dataset, outperforming the proposed DNN, whose accuracy is equal to 78.26%. For the CIC-BoT-IoT-V2 dataset, the DNN achieves an accuracy of 52.12%.
Experimental results show that ensemble learning approaches outperform neural networks in terms of classification accuracy for intrusion detection on structured data, while DNN can still be considered as a viable option for designing intelligent cybersecurity solutions

Impact Statement
The rapid evolution of cyber attacks means that there is the need for smart intrusion detection systems capable of detecting various types of cyber attacks. The presented research gives an overview of differences between deep and ensemble learning approaches in terms of the same pre-processing and evaluation setup applied to two standard data sets. The outcomes of the experiments can be beneficial for researchers and cyber security experts as guidance in choosing proper machine learn-ing methods for detecting network intrusion attacks. Despite positive outcomes gained, the research reveals the role of imbalance and heterogeneity of data sets..