Revisiting Intrusion Detection: A Comparative Benchmark of Supervised Learning Models on the KDD Cup 1999 Dataset
摘要
Intrusion Detection Systems (IDS) play a critical role in safeguarding networks from increasingly sophisticated cyberattacks. This paper presents a comprehensive comparative study of six supervised learning models, which are Random Forest, XGBoost, LightGBM, Support Vector Machine (SVM), Multi-Layer Perceptron (MLPClassifier), and Deep Neural Network (DNN), applied to the KDD Cup 1999 dataset for multi-class intrusion detection. The study evaluates each model’s performance across five attack categories: Normal, DoS, Probe, R2L, and U2R, using standardized preprocessing and a consistent experimental setup. Models are assessed using accuracy, precision, recall, F1-score, and ROC-AUC, with a focus on macro-averaged metrics due to the dataset’s class imbalance. Results show that XGBoost achieved the highest overall performance, with strong precision and superior detection of minority attack types, followed closely by Random Forest and LightGBM. In contrast, SVM exhibited the weakest recall and F1-score, particularly for rare classes. This benchmark highlights the effectiveness of tree-based ensemble methods in intrusion detection and offers insights into the trade-offs between accuracy, interpretability, and inference efficiency.