ANALYSE COMPARATIVE DES ARCHITECTURES DE DEEP LEARNING (RNN, MLP, CNN) POUR LA DETECTION PROACTIVE D’INTRUSIONS DANS LES RESEAUX INFORMATIQUES A L’AIDE DES BASES NSL-KDD ET UNSW-NB15

Abstract

This study presents a comparative evaluation of three deep learning architectures (RNN, CNN, and MLP) for early intrusion detection using the NSL-KDD and UNSW-NB15 datasets. The results show that, on NSL-KDD, the RNN achieves the best overall performance (accuracy ≈ 77.9%; F1-score ≈ 77.5%), while the CNN stands out with high sensitivity (≈ 94.2%), despite a moderate recall indicating the presence of false negatives. In contrast, on UNSW-NB15, all models achieve high overall performance (accuracy > 93%). The RNN (LSTM) demonstrates strong effectiveness with high sensitivity (≈ 98.8%) and F1-score (≈ 94.9%), confirming its suitability for proactive intrusion detection. The CNN attains the highest precision (≈ 95.8%), whereas the MLP shows a high recall (≈ 95.3%). Overall, these findings confirm the effectiveness of Deep Learning approaches for intrusion detection, with a notable advantage of recurrent models in capturing the temporal dynamics of network traffic.