Comparative Analysis of Random Forest and Artificial Neural Network Models for Network Traffic Anomaly Detection on the NSL-KDD Dataset

Abstract

The volume and sophistication of network attacks have grown faster than the signature databases on which conventional intrusion detection systems depend, and behaviour-based anomaly detection has become the principal alternative. This paper reports a controlled comparison of a random forest (RF) classifier and a multilayer perceptron artificial neural network (ANN) for binary anomaly detection on the NSL-KDD benchmark, which removes the duplicate records and the unrealistic class distribution of its KDD Cup 1999 predecessor. Both models are trained under a single preprocessing pipeline consisting of label standardisation, one-hot encoding of the three nominal attributes, a logarithmic transformation of the heavy-tailed volume attributes, min–max scaling to the unit interval, and synthetic minority over-sampling applied to the training partition only. Evaluation on the held-out KDDTest+ partition shows that the two architectures separate along a false-alarm/detection trade-off rather than along overall accuracy. The random forest reaches 76.54% accuracy with 267 false positives and an area under the receiver operating characteristic curve of 0.9609, whereas the neural network reaches 79.85% accuracy and detects 1,221 more attacks, at the cost of 742 false positives and a lower area under the curve of 0.8797. Both models exceed 99% accuracy on the training partition, so the drop of roughly twenty percentage points on the test partition is attributed to attack families that are absent from the training data rather than to a deficiency of either architecture. The serialised models are finally exposed through a packet-capturing web service, so that the comparison is grounded in a deployable prototype and not in an offline benchmark alone.