A Comparative Study of the Performance of Machine Learning Methods and Deep Neural Networks in Network Intrusion Detection - Thesis

Aug 3, 2026

Upload by Maeve

Intrusion detection systems (IDS) can be strengthened by training machine learning models to recognize normal traffic that should be permitted and abnormal traffic that should be denied. The study evaluates multiple machine learning approaches to improve the ability to separate normal behavior from attack activity. Using the NSL-KDD dataset, models are compared to identify the most informative features for classification. SHAP analysis is then applied to quantify which features most strongly influence model decisions and performance.

LanguageEnglish

CategoryResearch & Report

FormatPDF

Pages82

Reading Time3 h 27 min

AccessFree to download

ABSTRACT

DEDICATION

ACKNOWLEDGEMENTS

CHAPTER 1. INTRODUCTION

1.1 Research Questions

CHAPTER 2. RELATED WORKS

2.1 Datasets

2.2 Choosing a Dataset

2.3 Categories of the Attack Data

2.4 Machine Learning Models

A COMPARATIVE STUDY OF THE PERFORMANCE OF MACHINE LEARNING METHODS AND DEEP NEURAL NETWORKS IN NETWORK INTRUSION DETECTION By Milan Artis Dr. Shahnewaz Karim Sakib Dr. Joseph Kizza Assistant Professor of Computer Science Professor of Computer Science (Chair) (Committee Member) Dr. Hong Qin Associate Professor of Computer Science (Committee Member) A COMPARATIVE STUDY OF THE PERFORMANCE OF MACHINE LEARNING METHODS AND DEEP NEURAL NETWORKS IN NETWORK INTRUSION DETECTION By Milan Artis A Thesis Submitted to the Faculty of the University of Tennessee at Chattanooga in Partial Fulfillment of the Requirements of the Master of Science in Computer Science with a Concentration in Cyber Security The University of Tennessee at Chattanooga Chattanooga, Tennessee August 2024 Copyright © 2024 By Milan Reneé Artis All Rights Reserved ABSTRACT Intrusion detection systems (IDS) can be improved by using machine learning to teach the IDS what traffic is normal and therefore should be allowed into a network, or what traffic is abnormal and should be denied access to a network. The performance of intrusion detection systems can be improved through the use of machine learning methods that can accurately identify and classify normal attack versus attack traffic. There are numerous machine learning methods that can be employed for the purpose of improving intrusion detection. We use the NSL-KDD dataset to evaluate various machine learning models in order to determine the most relevant features for differentiating between normal and attack traffic. Then, we perform SHAP analysis to determine which features have greater effect on the models. DEDICATION This work is dedicated to my parents, Maurice and Yvonne, and my sister, Maurielle, for their wisdom, encouragement, steadfast support and unconditional love that have guided me through many challenges and shaped me into the person I am today. Thank you for always believing in me, and for reminding me to never give up. ACKNOWLEDGEMENTS I would like to thank my committee chair Dr. Shahnewaz Karim Sakib for his invaluable guidance and support throughout my thesis journey. His expertise, encouragement, and insightful feedback have been fundamental in navigating the complexities of my research. I am truly grateful and fortunate to have had him as my advisor. I would also like to thank Dr. Hong Qin for his perspective and guidance, especially during the initial stages of research. His input helped set the foundation for my work. Finally, I want to thank Dr. Joseph Kizza for his steadfast guidance and support, which has spanned almost the entirety of my academic journey. His willingness to lend expertise and encouragement whenever needed has been a continual source of inspiration to me. His unwavering support has made a lasting impact on my academic and personal growth. TABLE OF CONTENTS ABSTRACT.................................................................................................................................. iv DEDICATION .............................................................................................................................. v [ACKNOWLEGEMENTS............................................................................................................. vi](ACKNOWLEGEMENTS............................................................................................................. vi) [LIST OF TABLES ...............................](LIST OF TABLES ...............................)......................................................................................... x LIST OF FIGURES ...................................................................................................................... xi LIST OF ABBREVIATIONS......................................................................................................xiv CHAPTER 1. INTRODUCTION ............................................................

FAQs

What problem does this thesis address in network security?

It addresses how to improve intrusion detection by enabling systems to distinguish normal traffic from attack traffic using machine learning.

Which dataset is used to evaluate the machine learning models?

The NSL-KDD dataset is used to evaluate various machine learning models and to determine relevant features for separating normal and attack traffic.

How are feature importance and influence on model decisions analyzed?

SHAP analysis is performed to identify which features have greater effect on the models.

Aug 3, 2026

Upload by Maeve