Robust Anomaly Detection in Network Traffic: Evaluating Machine Learning Models on CICIDS2017

Zhaoyang Xu, Yunbo Liu
6/23/2025
cs.CRcs.AIcs.LG

No confident code implementation found for this paper. 9 possible matches can be shown below.

Abstract

Identifying suitable machine learning paradigms for intrusion detection remains critical for building effective and generalizable security solutions. In this study, we present a controlled comparison of four representative models - Multi-Layer Perceptron (MLP), 1D Convolutional Neural Network (CNN), One-Class Support Vector Machine (OCSVM) and Local Outlier Factor (LOF) - on the CICIDS2017 dataset under two scenarios: detecting known attack types and generalizing to previously unseen threats. Our results show that supervised MLP and CNN achieve near-perfect accuracy on familiar attacks but suffer drastic recall drops on novel attacks. Unsupervised LOF attains moderate overall accuracy and high recall on unknown threats at the cost of elevated false alarms, while boundary-based OCSVM balances precision and recall best, demonstrating robust detection across both scenarios. These findings offer practical guidance for selecting IDS models in dynamic network environments.

View on arXivView PDF

Code Implementations

No confident code match yet

We couldn't find an author-owned or strongly-evidenced community implementation for this paper. 9 weaker matches are hidden by default — verify before relying on them.

No code implementations found yet.

Know of an implementation? Let us know in the comments below!

Similar Papers

Hyperparameter Tuning-Based Optimized Performance Analysis of Machine Learning Algorithms for Network Intrusion Detection

87% match2025

Evaluating ML-Based Anomaly Detection Across Datasets of Varied Integrity: A Case Study

86% match1 repo2024

A Defensive Framework Against Adversarial Attacks on Machine Learning-Based Network Intrusion Detection Systems

85% match2025

Machine learning-based network intrusion detection for big and imbalanced data using oversampling, stacking feature embedding and feature extraction

85% match1 repo2024

An Adversarial Robustness Benchmark for Enterprise Network Intrusion Detection

84% match2024

Anomaly Detection Dataset for Industrial Control Systems

84% match2023

Cite this paper

@article{xu2025robust,
  title  = {Robust Anomaly Detection in Network Traffic: Evaluating Machine Learning Models on CICIDS2017},
  author = {Zhaoyang Xu and Yunbo Liu},
  year   = {2025},
  eprint = {2506.19877},
  archivePrefix = {arXiv},
  url    = {http://arxiv.org/abs/2506.19877v2}
}

Add a badge to your README

Shows whether official code is linked for this paper.

Code of Paper badge
[![Code of Paper](https://codeofpaper.com/badge/2506.19877.svg)](https://codeofpaper.com/paper/2506.19877)

Discussion