Benchmarking AI-Based Intrusion Detection Models for Cyber-Physical Systems: A Dataset-Driven Analysis

ABSTRACTAn ensemble‐inspired intrusion detection approach for cyber‐physical systems (CPSs) has been proposed. CPSs are susceptible to different cyber‐attacks. Attacks on CPSs result in the hindrance of critical services made available by them. To protect CPSs various intrusion detection systems (IDSs) exist. However, present IDSs have limitations of constrained detection accuracy, high false alarm rate, and latency. A hybrid intrusion detection approach for CPSs that integrates the pros of bagging and boosting methods has been proposed to minimize the mentioned limitations. The proposed approach uses AdaBoost and random forest (RF) algorithms as base models. Optimal features most indicative of attack behavior are selected based on the aggregated significant scores of each feature calculated using the base models. The base models are retrained using the selected features. The final selection of features is predicted by adopting the majority vote technique. The proposed method is implemented on the CIC‐IoT‐2023 dataset for multiclassification of intrusions. Thereby selecting only the best‐exclusive number of features for intrusion detection, the proposed approach gives better results like accuracy (98.27%), precision (0.98), recall (0.98), F1‐score (0.98), average false positive rate (FPR) (0.0006), and testing time (0.1563s). By conducting extensive experiments, it has been observed that selecting the best 21 out of 46 features aids in minimizing the space and time complexities of the proposed approach. The proposed approach performs better than the existing state‐of‐the‐art approaches available in the literature regarding FPR and testing time.

A Wireless Sensor Network (WSN) encompasses interconnected Sensor Nodes (SNs) that interact wirelessly to collect and transfer data. Security in the context of WNS refers to protocols and measures implemented for the overall functionality of the network, along with protecting the availability, confidentiality, and integrity of data against tampering, unauthorized access, and other possible security risks. An Intrusion Detection System (IDS) utilizing Deep Learning (DL) and Feature Selection (FS) leverages advanced methods to enhance effectiveness in the detection of malicious activities in a network by enhancing relevant data features and leveraging the power of Deep Neural Networks (DNNs). This study presents a Dynamic Arithmetic Optimization Algorithm within a DL-based IDS (DAOADL-IDS) in WSNs. The purpose of DAOADL-IDS is to recognize and classify intrusions in a WSN using a metaheuristic algorithm and DL models. To accomplish this, the DAOADL-IDS technique utilizes a Z-score data normalization approach to resize the input dataset in a compatible format. In addition, DAOADL-IDS employs a DAOA-based FS (DAOA-FS) model to select an optimum set of features. A Stacked Deep Belief Network (SDBN) model is employed for the Intrusion Detection (ID) process. The hyperparameter selection of the SDBN model is accomplished using the Bird Swarm Algorithm (BSA). A wide experimental analysis of the proposed DAOADL-IDS method was performed on a benchmark dataset. The performance validation of the DAOADL-IDS technique showed an accuracy of 99.68%, demonstrating superior performance over existing techniques under various measures.

The cyber attack has been growing rapidly on IoT(Internet of things). Existing security mechanisms are no longer sufficient to detect and mitigate these attacks. Intrusion Detection Systems have come up as the second line of defense; however, classic techniques have always had problems with novel and complex attacks. This paper presents a proposed hybrid deep learning-based intrusion detection system that combines Autoencoder, LSTM, and CNN architectures in a complementary fashion to achieve accurate and robust intrusion detection. The evaluated system has been tested with the NSL-KDD dataset, where a stratified cross-validation technique is applied for the generalizability of the result. The approach demonstrates very high accuracy, precision, and recall and is markedly superior to traditional and single-model deep learning approaches. Comprehensive literature reviews are provided, motivation and objectives are discussed, research gaps are identified, and the workflow, model architecture, dataset characteristics, and result analysis have been detailed.

Although Software-defined networking (SDN) is a promising architecture that simplifies network management and control, it also faces security problems that may affect the whole network. Hence, protecting strategies, such as intrusion detection and prevention system (IDPS), are in need in the SDN context. The potential of machine learning-based solutions can become the motivation of cut-edge deep learning-based intrusion detection system that can leverage the centralized control and view of the controller to secure the underlying infrastructure. However, performing additional IDPS functions in the controller, which needs to process enormous traffic amounts, can overload this component, and slow down the network. This paper introduces an approach of Big Data analysis for intrusion detection system in SDN, named BIDSDN to enhance the classification perfor-mance with a massive amount of network traffic data. Specifically, we leverage Apache Spark to deploy the distributed deep learning – based detector to reduce the processing time on complex algorithms. The experiments conducted on CICIDS2018 dataset with distributed cluster prove the efficacy in tackling the Big Data-related issues in the large-scale network like SDN.

In the fast-changing era of data communication, cyber-attacks and unauthorized access pose a significant threat to system and network security. Conventional Intrusion Detection Systems (IDS) are plagued by low accuracy and high false positives, which erode their usefulness in real-time intrusion detection. To overcome this issue, a new hybrid approach is proposed where Rough Set Theory (RST) is used for feature selection and Support Vector Machine (SVM) for classification. The main aim is to improve the detection accuracy while, at the same time, minimizing the complexity and dimensionality of data and processing. RST successfully filters out the most important features from the network traffic data and eliminates redundant or irrelevant attributes before forwarding the pre-processed data to the SVM classifier. This, besides lowering the processing complexity, also enhances the classification performance. The novelty lies in the combined application of RST and SVM, hence offering a more efficient alternative to existing methods like Principal Component Analysis (PCA). The proposed IDS exhibits enhanced detection accuracy with an appreciable reduction in false positives, hence offering a more efficient and reliable intrusion detection mechanism.

Though large amounts of work with artificial intelligence are used in typhoon rainfall forecasting, the predictive skills of existing models are unsatisfactory. To address this problem, this study aims to propose an improved cluster‐wise typhoon rainfall forecasting model that integrates the grid‐search cross‐validation method with machine learning and deep learning (DL) models including support vector machine (SVM), random forest (RF), adaptive boosting (AdaBoost), convolutional neural network (CNN), and long short‐term memory (LSTM). Grid‐search cross‐validation is a modified parameterization technique that helps to find the best parameters for machine/DL models. In the first stage, a second‐order polynomial regression model was used to cluster the typhoon track; and in the second stage, cluster‐wise typhoon rainfall was recognized within a 500 km radius from each typhoon center. After that, a modified cluster‐wise typhoon rainfall forecasting model was proposed using cluster‐wise antecedent hourly typhoon rainfall within this distance for 1–6 hr lead time. Results show that the proposed model based on the SVM, RF, AdaBoost, CNN, and LSTM is capable of providing more accurate forecasts (the efficiency of the forecast is increased by 45%–90%) than the existing typhoon rainfall forecasting models that are based on SVM with a genetic algorithm, RF, artificial neural network, multilayer perceptron network, and deep neural network. Therefore, the current study recommends using cluster‐wise typhoon rainfall forecasting model with a grid‐search cross‐validation method for disaster prevention and mitigation.

Intrusion detection systems (IDS) are used in analyzing huge data and diagnose anomaly traffic such as DDoS attack; thus, an efficient traffic classification method is necessary for the IDS. The IDS models attempt to decrease false alarm and increase true alarm rates in order to improve the performance accuracy of the system. To resolve this concern, three machine learning algorithms have been tested and evaluated in this research which are decision jungle (DJ), random forest (RF) and support vector machine (SVM). The main objective is to propose a ML-based network intrusion detection system (ML-based NIDS) model that compares the performance of the three algorithms based on their accuracy and precision of anomaly traffics. The knowledge discovery in databases (KDD) methodology and intrusion detection evaluation dataset (CIC-IDS2017) are used in the testing which both are considered as a benchmark in the evaluation of IDS. The average accuracy results of the SVM is 98.18%, RF is 96.76% and DJ is 96.50% in which the highest accuracy is achieved by the SVM. The average precision results of the SVM is 98.74, RF is 97.96 and DJ is 97.82 in which the SVM got a higher average precision compared with the other two algorithms. The average recall results of the SVM is 95.63, RF is 97.62 and DJ is 95.77 in which the RF achieves the highest average of recall than SVM and DJ. In overall, the SVM algorithm is found to be the best algorithm that can be used to detect an intrusion in the system.

This study presents a comprehensive analysis of machine learning techniques for measuring and predicting security in stock markets, comparing the performance of supervised, unsupervised, and deep learning models. Using a diverse dataset from Kaggle that includes historical stock prices, financial news sentiment, company fundamentals, and macroeconomic indicators, we applied feature engineering and rigorous preprocessing methods to optimize model accuracy. The study evaluated Random Forest, Support Vector Machines (SVM), K-Means clustering, and Long Short-Term Memory (LSTM) networks across key performance metrics. Results indicate that Random Forest outperformed other models in classification tasks with an accuracy of 92%, making it highly effective for real-time security assessment. SVM also demonstrated strong classification capabilities, particularly in high-dimensional spaces, with an accuracy of 88%. K-Means and DBSCAN clustering algorithms excelled in anomaly detection, identifying unusual patterns that could signal market irregularities. LSTM models, designed for time-series forecasting, achieved a root mean square error (RMSE) of 1.78, proving their utility in predicting future stock trends but requiring more computational resources.Our findings suggest that a hybrid approach, combining the strengths of supervised and deep learning models, can provide a robust solution for stock market security measurement. By leveraging explainable AI techniques such as SHAP and LIME, we also improved model interpretability, making these predictions more actionable for stakeholders. This research highlights the potential of machine learning in financial security monitoring and supports the growing integration of AI in the finance industry.

In recent years, with increasing use of internet the computer systems are facing many number of security issues. Intrusion detection system (IDS) is one of the principal components of any information security system. Identification of anomalous activity in computer network is first step in identifying the threat to information system. Our focus is mainly on Genetic algorithm (GA) based anomaly detection technique, as GA is one of the most effective evolutionary techniques for machine learning. In this paper Genetic algorithm is applied for network intrusion detection. Our approach for optimization specifically focusing on false positive rate. Reduction in false positive rate also improves accuracy and performance. The limitation of other techniques of accuracy, false positive rates has been addressed in this paper. Experimental results show the efficient detection rates based on KDD99cup datasets which is a standard dataset for intrusion detection.

The swift advancement of cyberattacks, particularly zero-day vulnerabilities, presents considerable difficulties for intrusion detection systems (IDSs) within 5G/6G and IoT-enabled networks. Current deep learning-based Intrusion Detection Systems, while successful, frequently exhibit deficiencies in scalability, interpretability, and robustness within heterogeneous and resource-limited contexts. This research presents a federated ensemble Intrusion Detection System (IDS) that amalgamates Convolutional Neural Networks (CNNs), Long Short-Term Memory (LSTM) networks, and Transformers to concurrently record geographical, temporal, and contextual patterns in network traffic. Federated learning with aggregation algorithms is implemented to facilitate privacy-preserving training. Model transparency is improved using explainable AI (XAI) tools, such as SHAP, LIME, and counterfactual explanations, which offer interpretable decision assistance. Additionally, a GAN-based adversarial defense is integrated to enhance robustness against evasion attacks. The model undergoes thorough evaluation on benchmark datasets (NSL-KDD, UNSW-NB15, CICIDS2017, CSE-CIC-IDS2018, TON_IoT20, Edge-IIoTset) and is validated on a practical IoT edge testbed utilizing Raspberry Pi and Jetson Nano devices. Experimental findings indicate exceptional predictive performance (accuracy reaching 98.5%, AUC-ROC exceeding 0.99), enhanced adversarial resilience, and efficient inference on edge devices. The suggested methodology provides a scalable, interpretable, and robust IDS framework appropriate for advanced intelligent networks.

The Internet of Things (IoT) holds transformative potential in fields such as power grid optimization, defense networks, and healthcare. However, the constrained processing capacities and resource limitations of IoT networks make them especially susceptible to cyber threats. This study addresses the problem of detecting intrusions in IoT environments by evaluating the performance of deep learning (DL) models under different data and algorithmic conditions. We conducted a comparative analysis of three widely used DL models—Convolutional Neural Networks (CNNs), Long Short-Term Memory (LSTM), and Bidirectional LSTM (biLSTM)—across four benchmark IoT intrusion detection datasets: BoTIoT, CiCIoT, ToNIoT, and WUSTL-IIoT-2021. Each model was assessed under balanced and imbalanced dataset configurations and evaluated using three loss functions (cross-entropy, focal loss, and dual focal loss). By analyzing model efficacy across these datasets, we highlight the importance of generalizability and adaptability to varied data characteristics that are essential for real-world applications. The results demonstrate that the CNN trained using the cross-entropy loss function consistently outperforms the other models, particularly on balanced datasets. On the other hand, LSTM and biLSTM show strong potential in temporal modeling, but their performance is highly dependent on the characteristics of the dataset. By analyzing the performance of multiple DL models under diverse datasets, this research provides actionable insights for developing secure, interpretable IoT systems that can meet the challenges of designing a secure IoT system.

As the reliance on digital networks grows, the need for robust security measures becomes paramount. It offers a thorough analysis of creating and assessing a Network Intrusion Detection System (NIDS) incorporating various machine learning algorithms. The selected algorithms consist of K Nearest Neighbour, Naïve Bayes, Decision Tree, Support Vector Machine, and Logistic Regression. Moreover, widely recognised ensemble learning models like CatBoost, AdaBoost, Gradient Boost, Random Forest, and Extreme Gradient Boost. The core objective is to improve the efficiency of intrusion detection by evaluating various machine-learning models. Utilizes feature selection techniques based on chi-square to enhance the relevance and effectiveness of the selected features. The evaluation metrics, particularly Matthews’ Correlation Coefficient (MCC) and ROC Curves, are used in assessing the models’ efficacy. They offer valuable insights into the models’ capability to differentiate between normal and malicious network activities. This study aims to advance cybersecurity by comparing classical machine learning and ensemble models for network intrusion detection. Significantly, our results underscore XGBoost’s effectiveness with 0.996 accuracy and 0.993 MCC, in enhancing digital network security.

Intrusion Detection Systems (IDS) are vital for securing cloud environments, where dynamic scalability and distributed architecture present significant security challenges. Accurate, real-time threat detection with minimal false positives is essential for effective cloud protection. Traditional machine learning models such as Support Vector Machines (SVM) and Random Forests have been applied in IDS but often struggle with high false positive rates and limited effectiveness against novel or zero-day attacks. A deep neural network (DNN) architecture is designed, incorporating multiple ReLU-activated hidden layers and dropout layers to prevent overfitting. The model is trained using the Adam optimizer and categorical cross-entropy loss to ensure efficient learning and responsiveness. Evaluation on NSL-KDD and CICIDS2017 datasets demonstrates high detection accuracy—98.7% and 97.4% respectively—along with reduced false positive rates and promising results in identifying zero-day attacks during simulation. Future work includes integrating federated learning to support distributed deployment and enhance privacy preservation.

Adversarial attacks aim to deceive the target system. Recently, deep learning methods have become a target of adversarial attacks. Even small perturbations could lead to classification errors in deep learning models. In an intrusion detection system using deep learning method, adversarial attack can cause classification error and malicious traffic can be classified as benign. In this study, the effects of adversarial attacks on the accuracy of deep learning-based intrusion detection systems were examined. CICIDS2017 dataset was used to test the detection systems . At first, DDoS attacks weredetected using Autoencoder, MLP, AEMLP, DNN, AEDNN, CNN and AECNN methods. Then, the Fast Gradient Sign Method (FGSM) is used to perform adversarial attacks. Finally, the sensitivity of the methods against the adversarial attacks were examined. Our results showed that the classification performance of deep learning based detection methods decreased up to %17 after the adversarial attacks. The results obtained in this study form the basis for the validation and validation studies of learning-based intrusion detection systems.

Detection of breast cancer remains an important global health issue, particularly in patients with dense breast tissue. Despite wide use of machine learning for breast cancer diagnosis, many existing studies rely on single-model evaluations and lack rigorous statistical validation, while transformer-based models remain insufficiently explored for structured tabular biomedical data. Using the Wisconsin Breast Cancer Diagnostic (WBCD) dataset, this study presents a comparative analysis of machine learning, deep learning, and transformer-based models for binary classification of breast masses as benign or malignant. A robust preprocessing and feature engineering pipeline was applied, and Support Vector Machine (SVM), Random Forest (RF), Multi-Layer Perceptron (MLP), Recurrent Neural Networks (RNN), Long Short-Term Memory (LSTM), and BERT-based models were evaluated using a stratified 66–34% train–test split and stratified 5-fold cross-validation. Performance was assessed using standard classification metrics, Jaccard Index, AUC-ROC, false negative rate, and statistical significance testing (paired t-tests and Bayesian analysis). Three-layer RNN and LSTM models achieved the highest accuracy of 98.25%, showing statistically significant improvement over SVM (p = 0.042), while the optimized SVM demonstrated strong performance with superior computational efficiency. BERT-based models yielded lower accuracy (92.98%), reflecting domain mismatch between language-pretrained transformers and numerical tabular data. These findings indicate that deeper recurrent architectures provide superior diagnostic performance, while SVM remains a practical and efficient alternative for clinical deployment.