# On the Evaluation of Sequential Machine Learning for Network Intrusion Detection

arXiv: https://arxiv.org/abs/2106.07961 · HTML: https://mlsanity.com/paper/2106.07961/

## Key facts

- Cited by 3 papers in the map (data through 14 Oct 2026).
- Builds on 10 of its 37 references that are in the map.
- First posted on arXiv 15 Jun 2021.

## Builds on (most cited first, 10 of 10)

- [Gate-Variants of Gated Recurrent Unit (GRU) Neural Networks](https://mlsanity.com/paper/1701.05923/) (2017)
- [TESSERACT: Eliminating Experimental Bias in Malware Classification across Space and Time](https://mlsanity.com/paper/1807.07838/) (2018)
- [How to Construct Deep Recurrent Neural Networks](https://mlsanity.com/paper/1312.6026/) (2013)
- [Learning Deep Networks from Noisy Labels with Dropout Regularization](https://mlsanity.com/paper/1705.03419/) (2017)
- [Network Traffic Anomaly Detection Using Recurrent Neural Networks](https://mlsanity.com/paper/1803.10769/) (2018)
- [Sequence Aggregation Rules for Anomaly Detection in Computer Network Traffic](https://mlsanity.com/paper/1805.03735/) (2018)
- [LuNet: A Deep Neural Network for Network Intrusion Detection](https://mlsanity.com/paper/1909.10031/) (2019)
- [Tracking Temporal Evolution of Network Activity for Botnet Detection](https://mlsanity.com/paper/1908.03443/) (2019)
- [Network Intrusion Detection based on LSTM and Feature Embedding](https://mlsanity.com/paper/1911.11552/) (2019)
- [Botnet Detection Using Recurrent Variational Autoencoder](https://mlsanity.com/paper/2004.00234/) (2020)

## Built on by (most cited first, 3 of 3)

- [The Role of Machine Learning in Cybersecurity](https://mlsanity.com/paper/2206.09707/) (2022)
- [SoK: Pragmatic Assessment of Machine Learning for Network Intrusion Detection](https://mlsanity.com/paper/2305.00550/) (2023)
- [Temporal Analysis of NetFlow Datasets for Network Intrusion Detection Systems](https://mlsanity.com/paper/2503.04404/) (2025)

## Abstract (arXiv)

Recent advances in deep learning renewed the research interests in machine learning for Network Intrusion Detection Systems (NIDS). Specifically, attention has been given to sequential learning models, due to their ability to extract the temporal characteristics of Network traffic Flows (NetFlows), and use them for NIDS tasks. However, the applications of these sequential models often consist of transferring and adapting methodologies directly from other fields, without an in-depth investigation on how to leverage the specific circumstances of cybersecurity scenarios; moreover, there is a lack of comprehensive studies on sequential models that rely on NetFlow data, which presents significant advantages over traditional full packet captures. We tackle this problem in this paper. We propose a detailed methodology to extract temporal sequences of NetFlows that denote patterns of malicious activities. Then, we apply this methodology to compare the efficacy of sequential learning models against traditional static learning models. In particular, we perform a fair comparison of a `sequential' Long Short-Term Memory (LSTM) against a `static' Feedforward Neural Networks (FNN) in distinct environments represented by two well-known datasets for NIDS: the CICIDS2017 and the CTU13. Our results highlight that LSTM achieves comparable performance to FNN in the CICIDS2017 with over 99.5% F1-score; while obtaining superior performance in the CTU13, with 95.7% F1-score against 91.5%. This paper thus paves the way to future applications of sequential learning models for NIDS.