# Robust Anomaly Detection in Network Traffic: Evaluating Machine Learning Models on CICIDS2017

arXiv: https://arxiv.org/abs/2506.19877 · HTML: https://mlsanity.com/paper/2506.19877/

## Key facts

- Cited by 4 papers in the map (data through 14 Oct 2026).
- Builds on 11 of its 26 references that are in the map.
- First posted on arXiv 23 Jun 2025.

## Builds on (most cited first, 11 of 11)

- [Large Language Models as Topological Structure Enhancers for Text-Attributed Graphs](https://mlsanity.com/paper/2311.14324/) (2023)
- [Post-Training Attribute Unlearning in Recommender Systems](https://mlsanity.com/paper/2403.06737/) (2024)
- [Evaluating Supervised Learning Models for Fraud Detection: A Comparative Study of Classical and Deep Architectures on Imbalanced Transaction Data](https://mlsanity.com/paper/2505.22521/) (2025)
- [SETransformer: A Hybrid Attention-Based Architecture for Robust Human Activity Recognition](https://mlsanity.com/paper/2505.19369/) (2025)
- [Making Users Indistinguishable: Attribute-wise Unlearning in Recommender Systems](https://mlsanity.com/paper/2310.05847/) (2023)
- [DDPM-MoCo: Advancing Industrial Surface Defect Generation and Detection with Generative and Contrastive Learning](https://mlsanity.com/paper/2407.03332/) (2024)
- [A Hybrid Deep Learning Anomaly Detection Framework for Intrusion Detection](https://mlsanity.com/paper/2212.00966/) (2022)
- [DRIVE: Dependable Robust Interpretable Visionary Ensemble Framework in Autonomous Driving](https://mlsanity.com/paper/2409.10330/) (2024)
- [Year-over-Year Developments in Financial Fraud Detection via Deep Learning: A Systematic Literature Review](https://mlsanity.com/paper/2502.00201/) (2025)
- [Research on Enhancing Cloud Computing Network Security using Artificial Intelligence Algorithms](https://mlsanity.com/paper/2502.17801/) (2025)
- [Guarding the Gate: ConceptGuard Battles Concept-Level Backdoors in Concept Bottleneck Models](https://mlsanity.com/paper/2411.16512/) (2024)

## Built on by (most cited first, 4 of 4)

- [CenterMamba-SAM: Center-Prioritized Scanning and Temporal Prototypes for Brain Lesion Segmentation](https://mlsanity.com/paper/2511.01243/) (2025)
- [Modality-Aware Infrared and Visible Image Fusion with Target-Aware Supervision](https://mlsanity.com/paper/2509.11476/) (2025)
- [Enhanced Pre-training of Graph Neural Networks for Million-Scale Heterogeneous Graphs](https://mlsanity.com/paper/2510.12401/) (2025)
- [Latent Sculpting for Zero-Shot Generalization: A Manifold Learning Approach to Out-of-Distribution Anomaly Detection](https://mlsanity.com/paper/2512.22179/) (2025)

## Abstract (arXiv)

Identifying suitable machine learning paradigms for intrusion detection remains critical for building effective and generalizable security solutions. In this study, we present a controlled comparison of four representative models - Multi-Layer Perceptron (MLP), 1D Convolutional Neural Network (CNN), One-Class Support Vector Machine (OCSVM) and Local Outlier Factor (LOF) - on the CICIDS2017 dataset under two scenarios: detecting known attack types and generalizing to previously unseen threats. Our results show that supervised MLP and CNN achieve near-perfect accuracy on familiar attacks but suffer drastic recall drops on novel attacks. Unsupervised LOF attains moderate overall accuracy and high recall on unknown threats at the cost of elevated false alarms, while boundary-based OCSVM balances precision and recall best, demonstrating robust detection across both scenarios. These findings offer practical guidance for selecting IDS models in dynamic network environments.