NetDAIL: An Optimized Deep Learning-Based Hybrid Model for Anomaly Detection in Network Traffic

Detecting rare and subtle anomalies is critical for ensuring cybersecurity, financial integrity, and operational safety. High-dimensional features, severe class imbalance, and large data volumes often challenge conventional intrusion detection methods. This study presents NetDAIL, a hybrid framework that integrates deep feature learning using a denoising autoencoder, anomaly scoring through Isolation Forest, and classification via LightGBM to address these challenges. To evaluate its effectiveness, the proposed framework was tested on two widely used benchmark datasets: NSL-KDD for controlled-scale experimentation and KDD Cup 1999 for large-scale evaluation. NetDAIL achieved an AUC of 0.998 on the NSL-KDD dataset and 0.990 on the KDD Cup 1999 dataset, demonstrating strong discriminative capability across different traffic volumes and attack patterns. Experimental results confirm the model’s high detection accuracy, scalability, and generalization across diverse network intrusion scenarios. These findings highlight NetDAIL as a practical and reliable solution for real-world anomaly detection, capable of efficiently handling both small- and large-scale environments while maintaining robust and effective performance in operational settings.

@article{Khalifa2025,
  title     = {NetDAIL: An Optimized Deep Learning-Based Hybrid Model for Anomaly Detection in Network Traffic},
  journal   = {International Journal of Advanced Computer Science and Applications},
  volume    = {16},
  number    = {10},
  year      = {2025},
  publisher = {The Science and Information Organization},
  author    = {Saad Khalifa and Mohamed Marie and Wael Mohamed},
  doi       = {10.14569/IJACSA.2025.0161014},
  url       = {https://doi.org/10.14569/IJACSA.2025.0161014}
}