A discrete mathematical framework for network intrusion detection with applications to cryptographic network security
Ajay KumarDepartment of Computer Science and EngineeringManipal University JaipurJaipur, Rajasthan, 303007, IndiaView full profile → , *Amit Kumar GuptaCorresponding authoramit.gupta@jaipur.manipal.eduDepartment of Computer Science & EngineeringFaculty of Science, Technology and Architecture (FoSTA)Manipal University JaipurJaipur, Rajasthan, 303007, IndiaView full profile → , Priya Mathurdrpriyamathur21@gmail.comDepartment of MathematicsPoornima Institute of Engineering and TechnologyJaipur, Rajasthan, 302022, IndiaView full profile → , Chaitanya Singher.chaitanyasingh@gmail.comDepartment of Computer EngineeringVidhyadeep UniversitySurat, Gujarat, 394110, IndiaView full profile → , Vipin Tiwarivipintiwari1@gmail.comDepartment of Computer Science and EngineeringSymbiosis Institute of Technology (SIT)Symbiosis International (Deemed University)Pune, Maharashtra, 412115, IndiaView full profile →
* Corresponding author · click or hover a name for details
- Received:
- 01 Dec 2025
- Published Online:
- 14 Aug 2026
- Article type:
- Research Article
- Language:
- EN
- Article no.:
- JDMSC-2698
- Pages:
- 3137–3147
Abstract
As computer networks expand, robust Intrusion Detection Systems (IDS) are crucial. Traditional methods struggle with zero-day attacks and lack interpretability. This study uses the NSL-KDD dataset and three machine learning models: Random Forest, attention-based Multilayer Perceptron (MLP), and hybrid CNN–BiLSTM. Models were evaluated on accuracy, error rate, ROC–AUC, and confusion matrix. The hybrid CNN–BiLSTM achieved 77.84% accuracy; attention-based MLP reached 0.9076 AUC. SHAP (Shapley Additive Explanations) analyzed key features in the Random Forest model, enhancing transparency. Results demonstrate the framework’s improved real-time intrusion detection performance with increased explainability and practical network security applicability.
Keywords
Subject Classifications
References
[1] W. Lee and S. J. Stolfo, “A framework for constructing features and models for intrusion detection systems,” ACM Trans. Inf. Syst. Secur., vol. 3, no. 4, pp. 227–261 (Nov. 2000), doi: 10.1145/382912.382914.
[2] D. E. Denning, “An intrusion-detection model,” IEEE Trans. Softw. Eng., vol. SE-13, no. 2, pp. 222–232 (Feb. 1987), doi: 10.1109/TSE.1987.232894.
[3] R. Sommer and V. Paxson, “Outside the closed world: On using machine learning for network intrusion detection,” in Proc. IEEE Symp. Security Privacy (S&P), Berkeley, CA, USA, pp. 305–316 (2010), doi: 10.1109/SP.2010.25.
[4] S. Axelsson, “Intrusion detection systems: A survey and taxonomy,” Technical Report No. 99-15, Dept. Comput. Eng., Chalmers Univ. Technol., Göteborg, Sweden, (Mar. 2000).
[5] T. K. Ho, “The random subspace method for constructing decision forests,” IEEE Trans. Pattern Anal. Mach. Intell., vol. 20, no. 8, pp. 832–844 (Aug. 1998), doi: 10.1109/34.709601.
[6] G. Kim, S. Lee, and S. Kim, “A novel hybrid intrusion detection method integrating anomaly detection with misuse detection,” Expert Syst. Appl., vol. 41, no. 4, pp. 1690–1700 (2014).
[7] C. Yin, Y. Zhu, J. Fei, and X. He, “A deep learning approach for intrusion detection using recurrent neural networks,” IEEE Access, vol. 5, pp. 21954–21961 (2017), doi: 10.1109/ACCESS.2017.2762418.
[8] J. Kim, J. Kim, H. L. T. Thu, and H. Kim, “Long short-term memory recurrent neural network classifier for intrusion detection,” in Proc. 15th IEEE Int. Conf. Mach. Learn. Appl. (ICMLA), Anaheim, CA, USA, pp. 471–476 (Dec. 2016), doi: 10.1109/ICMLA.2016.0086.
[9] N. Shone, T. N. Ngoc, V. D. Phai, and Q. Shi, “A deep learning approach to network intrusion detection,” IEEE Trans. Emerg. Topics Comput. Intell., vol. 2, no. 1, pp. 41–50 (Feb. 2018), doi: 10.1109/TETCI.2017.2772792.
[10] M. T. Ribeiro, S. Singh, and C. Guestrin, “Why should I trust you?: Explaining the predictions of any classifier,” in Proc. 22nd ACM SIGKDD Int. Conf. Knowl. Discovery Data Mining (KDD), San Francisco, CA, USA, pp. 1135–1144 (2016), doi: 10.1145/2939672.2939778.
[11] S. M. Lundberg and S.-I. Lee, “A unified approach to interpreting model predictions,” in Adv. Neural Inf. Process. Syst. (NeurIPS), vol. 30 (2017).
[12] M. Tavallaee, E. Bagheri, W. Lu, and A. A. Ghorbani, “A detailed analysis of the KDD CUP 99 data set,” in Proc. IEEE Symp. Comput. Intell. Security Defense Appl. (CISDA), Ottawa, ON, Canada, pp. 1–6 (2009), doi: 10.1109/CISDA.2009.5356528.
[13] D. Gaspar, P. Silva, and C. Silva, “Explainable AI for intrusion detection systems: LIME and SHAP applicability on multi-layer perceptron,” IEEE Access, vol. 12, pp. 30164–30175 (2024), doi: 10.1109/ACCESS.2024.3369874.
[14] P. Ramyavarshini, G. K. Sriram, U. Rajasekaran, and A. Malini, “Explainable AI for intrusion detection systems,” in Proc. 5th Int. Conf. Contemporary Computing and Informatics (IC3I), pp. 1563–1567 (2022), doi: 10.1109/IC3I56241.2022.10072682.
[15] H. Hindy, D. Brosset, E. Bayne, A. K. Seeam, X. Bellekens, C. Tachtatzis, and R. Atkinson, “A taxonomy of network threats and the effect of deep learning in cybersecurity,” IEEE Access, vol. 8, pp. 97433–97488 (2020), doi: 10.1109/ACCESS.2020.2995333.
[16] A. Y. Javaid, Q. Niyaz, W. Sun, and M. Alam, “A Deep Learning Approach for Network Intrusion Detection System,” EAI Endorsed Transactions on Security and Safety, vol. 3, no. 9, p. e2 (May 2016), doi: 10.4108/eai.3-12-2015.2262516.
[17] M. Tavallaee, E. Bagheri, W. Lu, and A. A. Ghorbani, “A detailed analysis of the KDD CUP 99 data set,” in Proc. 2009 IEEE Symp. Comput. Intell. Security Defense Appl. (CISDA), Ottawa, ON, Canada, pp. 1–6 (Jul. 2009), doi: 10.1109/CISDA.2009.5356528.
[18] C. M. Bishop, Pattern Recognition and Machine Learning. New York, USA: Springer (2006).
[19] T. Hastie, R. Tibshirani, and J. Friedman, The Elements of Statistical Learning: Data Mining, Inference, and Prediction, 2nd ed. New York, USA: Springer (2009).
[20] W. Lee and S. J. Stolfo, “A framework for constructing features and models for intrusion detection systems,” ACM Trans. Inf. Syst. Secur., vol. 3, no. 4, pp. 227–261 (Nov. 2000).
[21] V. P. Sharma, N. S. Yadav, S. S. Adavi, D. S. D. Reddy, and B. B. Gupta, “A two stage hybrid intrusion detection using genetic algorithm in IoT networks,” Journal of Discrete Mathematical Sciences and Cryptography, vol. 26, no. 3, pp. 667–676 (2023).
[22] S. K. Henge, A. Upadhyay, A. K. Saini, N. Mishra, D. Sharma, and G. Sharma, “Analysis and detection of insider attacks using behaviour rule-based architecture in enterprise multitenancy,” Journal of Discrete Mathematical Sciences and Cryptography, vol. 26, no. 3, pp. 707–718 (2023).
[23] P. Vats, S. K. Vats, and P. Peddi, “Unveiling crypto analysis secrets: A comprehensive analysis of smart contract security within blockchain network environments,” Journal of Discrete Mathematical Sciences and Cryptography, vol. 27, no. 4, pp. 1121–1128 (2024).
