Comparative Study of BiGRU with Multi-Head Attention and CNN for Network Intrusion Detection Using a Cleaned and Balanced CSE-CIC-IDS 2018 Dataset

Year 2025, Volume: 9 Issue: 4, 725 - 737, 08.10.2025

Suresh Kumar Balasubramanian , Senthilkumar Perumal

https://doi.org/10.31127/tuje.1695208

Abstract

With the age of advanced cyber attacks, robust intrusion detection systems are inevitable in order to protect the network from insecurity. This work presents a new comparative performance evaluation of two deep learning models, namely, Bidirectional Gated Recurrent Unit with Multi Head Attention (BiGRU + MHA) and Convolutional Neural Network (CNN), on the updated CSE-CIC-IDS 2018 dataset (Version 1, 2024). The data set was cleaned and balanced meticulously by eliminating duplicate entries and a two-stage resampling method with random undersampling accompanied with synthetic minority oversampling for accurate representation of both frequent as well as infrequent types of attacks. The experimental results confirm that both models provided superior detection performance, with BiGRU + MHA consistently outperforming CNN. Specifically, BiGRU + MHA provided 99.65 percent accuracy as well as ROC AUC of 99.71 percent, whereas CNN provided 98.85 percent accuracy as well as ROC AUC of 98.92 percent. The observations identify the advantage of using the combination of temporal sequence modeling as well as attention for identifying advanced intrusion patterns in network traffic. Generally, the results confirm that the use of deep temporal learning in combination with structured preparation of the data holds the capability for leading to highly effective intrusion detection, with great potential for strengthening cybersecurity solutions.

Keywords

Network Intrusion Detection , Deep Learning , BiGRU with Attention , Convolutional Neural Networks (CNN) , CSE-CIC-IDS2018 Dataset , Cybersecurity

References

• Yang, K., Wang, J., & Li, M. (2024). An enhanced IIoT intrusion detection method using BiGRU, attention, and Inception-CNN with hybrid sampling and feature selection. Scientific Reports, 14, 19339.
• Hu, Z., Liu, G., Li, Y., & Zhuang, S. (2024). SAGB: Self-attention with gate and BiGRU network for intrusion detection. Complex & Intelligent Systems, 10(6), 8467–8479.
• Song, Y., Luktarhan, N., Shi, Z., & Wu, H. (2023). TGA: A novel network intrusion detection method based on TCN, BiGRU and attention mechanism. Electronics, 12(13), 2881.
• Wang, Y. C., Houng, Y. C., Chen, H. X., & Tseng, S. M. (2023). Network anomaly intrusion detection based on deep learning approach. Sensors, 23(4), 2171.
• Alzughaibi, S., & El Khediri, S. (2023). A cloud intrusion detection system based on DNN using backpropagation and PSO on the CSE-CIC-IDS2018 dataset. Applied Sciences, 13(4), 2276.
• Cao, B., Li, C., Song, Y., Qin, Y., & Chen, C. (2022). Network intrusion detection model based on CNN and GRU. Applied Sciences, 12(9), 4184.
• Kanimozhi, V., & Jacob, T. P. (2021). Artificial intelligence outflanks all other machine learning classifiers in network intrusion detection system on the realistic cyber dataset CSE-CIC-IDS2018 using cloud computing. ICT Express, 7(3), 366–370.
• Cao, B., Li, C., Song, Y., & Fan, X. (2022). Network intrusion detection technology based on convolutional neural network and BiGRU. Computational Intelligence and Neuroscience, 2022, 1942847.
• Udurume, M., Shakhov, V., & Koo, I. (2024). Comparative analysis of deep convolutional neural network—Bidirectional long short-term memory and machine learning methods in intrusion detection systems. Applied Sciences, 14(16), 6967.
• Zhang, J., Zhang, X., Liu, Z., Fu, F., Jiao, Y., & Xu, F. (2023). A network intrusion detection model based on BiLSTM with multi-head attention mechanism. Electronics, 12(19), 3984.
• Guo, D., & Xie, Y. (2025). Research on network intrusion detection model based on hybrid sampling and deep learning. Sensors, 25(5), 1578.
• Susilo, B., Muis, A., & Sari, R. F. (2025). Intelligent intrusion detection system against various attacks based on a hybrid deep learning algorithm. Sensors, 25(2), 1234.
• Aljabri, J. (2025). Attack-resilient IoT security framework using multi-head attention-based representation learning with improved white shark optimization algorithm. Scientific Reports, 15(1), 14255.
• Wang, J., Yang, K., Cong, W., Li, M., Bai, L., & Wang, X. (2025, April). Network intrusion detection based on CNN-BiGRU. In International Conference on Advanced Information Networking and Applications (pp. 62–71). Springer Nature.
• Hu, Z., Li, Y., Liu, G., Wang, X., & Chen, M. (2025). CNN-KOA-BiGRU model for APT detection: Combining deep learning with optimization for improved feature extraction. IEEE Transactions on Network and Service Management, 22(1), 145–158.
• Hewapathirana, I. U. (2025). A comparative study of two-stage intrusion detection using modern machine learning approaches on the CSE-CIC-IDS2018 dataset. Knowledge, 5(1), 6.
• Li, B., Li, J., & Jia, M. (2025). ADFCNN-BiLSTM: A deep neural network based on attention and deformable convolution for network intrusion detection. Sensors, 25(5), 1382.
• Zhang, Y., Muniyandi, R. C., & Qamar, F. (2025). A review of deep learning applications in intrusion detection systems: Overcoming challenges in spatiotemporal feature extraction and data imbalance. Applied Sciences, 15(3), 1552.
• Deshmukh, A., & Ravulakollu, K. (2024). An efficient CNN-based intrusion detection system for IoT: Use case towards cybersecurity. Technologies, 12(10), 203.
• El-Shafeiy, E., Elsayed, W. M., Elwahsh, H., Alsabaan, M., Ibrahem, M. I., & Elhady, G. F. (2024). Deep complex gated recurrent networks-based IoT network intrusion detection systems. Sensors, 24(18), 5933.
• Liu, W., Chen, I., & Zhang, B. F. (2025). Ensemble of feature-augmented convolutional neural network and deep autoencoder for efficient detection of network attacks. Scientific Reports, 15, 4267.
• Han, J., & Pak, W. (2023). Hierarchical LSTM-based network intrusion detection system using hybrid classification. Applied Sciences, 13(5), 3089.
• Imrana, Y., Xiang, Y., Ali, L., Noor, A., Sarpong, K., & Abdullah, M. A. (2024). CNN-GRU-FF: A double-layer feature fusion-based network intrusion detection system using convolutional neural network and gated recurrent units. Complex & Intelligent Systems, 10(3), 3353–3370.
• Xin, Y., Kong, L., Liu, Z., Chen, Y., Li, Y., Zhu, H., & Wang, C. (2018). Machine learning and deep learning methods for cybersecurity. IEEE Access, 6, 35365–35381.
• Mohamed, A. (2024). CSE-CIC-IDS2018 [Data set]. Mendeley Data, V1.
• Gopalan, S. S., Ravikumar, D., Linekar, D., Raza, A., & Hasib, M. (2021). Balancing approaches towards ML for IDS: A survey for the CSE-CIC-IDS dataset. In 2020 International Conference on Communications, Signal Processing, and Their Applications (ICCSPA) (pp. 1–6). IEEE.
• Kamal, H., & Mashaly, M. (2024). Advanced hybrid Transformer-CNN deep learning model for effective intrusion detection systems with class imbalance mitigation using resampling techniques. Future Internet, 16(12), 481.
• Buda, M., Maki, A., & Mazurowski, M. A. (2018). A systematic study of the class imbalance problem in convolutional neural networks. Neural Networks, 106, 249–259.
• Abd Elrahman, S. M., & Abraham, A. (2013). A review of class imbalance problem. Journal of Network and Innovative Computing, 1, 9.
• Fernández, A., Garcia, S., Herrera, F., & Chawla, N. V. (2018). SMOTE for learning from imbalanced data: Progress and challenges, marking the 15-year anniversary. Journal of Artificial Intelligence Research, 61, 863–905.
• Korkmaz, E., & Şahin, U. (2024). Feature selection techniques for improving intrusion detection system performance. Turkish Journal of Engineering, 8(2), 289–302.
• Erdoğan, A., Kaya, N., & Tuncer, B. (2024). Comparative analysis of deep learning architectures for network security monitoring. Turkish Journal of Engineering, 8(1), 156–169.
• Vaswani, A., Shazeer, N., Parmar, N., Uszkoreit, J., Jones, L., Gomez, A. N., Kaiser, Ł., & Polosukhin, I. (2017). Attention is all you need. In Advances in Neural Information Processing Systems (Vol. 30).
• Benchama, A., Zebbara, K., Elasri, S., & Aftatah, M. (2024, April). Optimized CNN-BiGRU intrusion detection model with SMOTE enhancement: Using Optuna for automated hyperparameter tuning. In The International Workshop on Big Data and Business Intelligence (pp. 66–76). Springer Nature.
• Yang, K., Wang, J., & Li, M. (2024). An improved intrusion detection method for IIoT using attention mechanisms, BiGRU, and Inception-CNN. Scientific Reports, 14(1), 19339.
• Aydın, T., Çelik, S., & Yılmaz, H. (2024). Ensemble methods for network traffic classification in cybersecurity applications. Turkish Journal of Engineering, 8(3), 445–458.
• İncekara, C. (2024). Harnessing big data, IoT, and AI for smarter business analytics. Engineering Applications, 3(2), 137–146.
• Sinap, V. (2024). Comparative analysis of machine learning techniques for credit card fraud detection: Dealing with imbalanced datasets. Turkish Journal of Engineering, 8(2), 196–208.
• Singh, A. (2025). Real-time intrusion detection in edge computing using machine learning techniques. Turkish Journal of Engineering, 9(2), 385–393.
• Jain, A., Kumar, R., & Sharma, P. (2024). AI applications in civil engineering: Challenges and opportunities. Engineering Applications, 3(1), 45–58.
• Sinap, V. (2024). Machine learning approaches for fraud detection in financial systems. Turkish Journal of Engineering, 8(1), 112–125.
• Leka, B., & Hoxha, K. (2024). Software engineering methodologies in programming companies in Albania. Engineering Applications, 3(1), 85–91.
• Juraev, D. A., & Bozorov, M. N. (2024). The role of algebra and its application in modern sciences. Engineering Applications, 3(1), 59–67.
• Jain, R., Singh, S. K., Palaniappan, D., Parmar, K., & Premavathi, T. (2025). Data-driven civil engineering: Applications of artificial intelligence, machine learning, and deep learning. Turkish Journal of Engineering, 9(2), 445-462.
• Jain, R., Bekele, S., Palaniappan, D., & Parmar, K. Employing Deep Convolutional Neural Networks for Enhanced Precision in Potato and Maize Leaf Disease Detection and Classification. Turkish Journal of Engineering, 9(2), 290-301.
• Çubukçu, E. A., Demir, V., & Sevimli, M. F. (2022). Digital elevation modeling using artificial neural networks, deterministic and geostatistical interpolation methods. Turkish Journal of Engineering, 6(3), 199-205.
• Öztürk, A., Allahverdı, N., & Saday, F. (2022). Application of artificial intelligence methods for bovine gender prediction. Turkish Journal of Engineering, 6(1), 54-62.
• Singh, A. (2025). Real Time Intrusion Detection In Edge Computing Using Machine Learning Techniques. Turkish Journal of Engineering, 9(2), 385-393