Hierarchical and Sequence-Aware Deep Learning Models for Robust Intrusion Detection

Abstract

This research investigates the effectiveness of deep-learning architectures for intrusion detection using the NSL-KDD benchmark dataset. The study evaluates four models such as Convolutional Neural Network (CNN), Long Short-Term Memory Network (LSTM), Deep Neural Network (DNN), and Deep Belief Network (DBN) under two controlled train–test configurations (70–30 and 80–20). Comprehensive preprocessing, including normalization, one-hot encoding, and imbalance handling, ensures a robust feature space for training. Experimental results demonstrate that deep-learning models significantly enhance detection performance compared to conventional approaches, with DBN consistently achieving the highest accuracy, precision, recall, and F1-score across both scenarios. The 80% training condition further strengthens classification capability, confirming the benefit of representation learning on larger training volumes. The findings highlight the potential of hierarchical and sequence-aware deep architectures in improving the reliability of modern intrusion-detection systems.

Introduction

Intrusion Detection Systems (IDS) are critical for modern cybersecurity, detecting malicious activities in increasingly sophisticated network attacks. Traditional machine-learning models (SVM, NB, RF, MLP) rely on manual feature engineering and struggle with complex patterns, whereas deep learning (DL) offers automated representation learning, capturing spatial, temporal, and hierarchical structures for improved detection.

The NSL-KDD dataset, with 148,517 network records and 41 features, serves as a benchmark for IDS research, covering four attack types: DoS, Probe, U2R, and R2L. This study evaluates four deep models—CNN, LSTM, DNN, and DBN—under two training/testing splits (70–30 and 80–20) to analyze how architecture depth, representation learning, and training volume affect performance.

Key Contributions:

• Comparative evaluation of CNN, LSTM, DNN, and DBN on NSL-KDD.

• Analysis of training data proportion on model accuracy.

• Insights into hierarchical, sequential, and spatial feature learning for different attack types.

• Demonstration of DL models’ superiority over traditional ML classifiers.

• Recommendations for optimal DL architectures in next-generation IDS.

Methodology:

• Preprocessing includes normalization, one-hot encoding of categorical features, and balancing class distributions.

• CNN captures spatial correlations across features.

• LSTM models temporal dependencies.

• DNN learns deep nonlinear feature interactions.

• DBN uses layer-wise unsupervised pretraining to capture hierarchical patterns.

Results:

• In the 70–30 split, DBN achieved the highest accuracy (0.96), followed by DNN (0.95), LSTM (0.94), and CNN (0.93).

• In the 80–20 split, performance improved for all models, with DBN reaching 0.97 accuracy, demonstrating the benefits of additional training data and pretraining.

• Overall, deeper and pretraining-enabled architectures (DNN, DBN) outperformed CNN and LSTM, highlighting the importance of hierarchical feature extraction for robust IDS.

Conclusion

This research confirms that DL architectures significantly enhance intrusion-detection performance on the NSL-KDD dataset compared to traditional machine-learning models. Among the four models, the DBN achieved the highest results, with accuracy, precision, recall, and F1-score of 0.96 in the 70–30 training–testing split and 0.97 in the 80–20 split. The DNN and LSTM models also showed strong performance (0.94–0.96), while the CNN provided a reliable baseline (0.92–0.94). The results indicate that increasing the training data proportion enhances feature representation and model generalization. Overall, the findings highlight the superiority of deep hierarchical, sequential, and nonlinear learning models for accurate, robust, and scalable intrusion detection in modern network environments.

References

[1] Alashjaee, A.M. Deep learning for network security: an Attention-CNN-LSTM model for accurate intrusion detection. Sci Rep 15, 21856 (2025). [2] Bhuiyan, M. D. S. M., Rafi, M. D. A. L., Rodrigues, G. N., Mir, M. N. H., Ishraq, A., Mridha, M. F., & Shin, J. (2025). Deep learning for algorithmic trading: A systematic review of predictive models and optimization strategies. Array, 26, 100390. [3] Adefemi, K.O.; Mutanga, M.B. A Robust Hybrid CNN–LSTM Model for Predicting Student Academic Performance. Digital 2025, 5, 16. [4] Singh, V., Sahana, S.K. &Bhattacharjee, V. A novel CNN-GRU-LSTM based deep learning model for accurate traffic prediction. Discov Computing 28, 38 (2025). [5] Aman Kumar Singh, Gunjan Singh, Masood Husain Siddiqui, \"NSE and BSE data set (2023-2025) \", IEEE Dataport, November 26, 2025. [6] M. Mynuddin et al., \"Automatic Network Intrusion Detection System Using Machine Learning and Deep Learning,\" 2024 IEEE International Conference on Artificial Intelligence and Mechatronics Systems (AIMS), Bandung, Indonesia, 2024, pp. 1-9. [7] A. Modak and V. Dehalwar, \"Design and Analysis of Intrusion Detection Using Deep Learning Models,\" 2024 IEEE International Conference on Electronics, Computing and Communication Technologies (CONECCT), Bangalore, India, 2024, pp. 1-6. [8] N. K. Sah, M. Kolli, K. P. Dharmaraj and H. N. Vishwas, \"Comparative Deep Learning Approach for Intrusion Detection,\" 2024 15th International Conference on Computing Communication and Networking Technologies (ICCCNT), Kamand, India, 2024, pp. 1-6. [9] M. Moawad, V. W. Tze, P. T. Hang Hui and J. Y. Hsien Ming, \"Deep Learning Based Intrusion Detection for Internet of Things and Edge Devices,\" 2023 IEEE Asia-Pacific Conference on Computer Science and Data Engineering (CSDE), Nadi, Fiji, 2023, pp. 01-06. [10] A. Rathee, P. Malik and M. Kumar Parida, \"Network Intrusion Detection System using Deep Learning Techniques,\" 2023 International Conference on Communication, Circuits, and Systems (IC3S), BHUBANESWAR, India, 2023, pp. 1-6.

Copyright

Copyright © 2025 L. Parthasarathi, Dr. N. Kamalraj. This is an open access article distributed under the Creative Commons Attribution License, which permits unrestricted use, distribution, and reproduction in any medium, provided the original work is properly cited.