{"id":"https://openalex.org/W7225747638","doi":"https://doi.org/10.5281/zenodo.24098183","title":"Performance vs. Accuracy Trade-Off Analysis of Tree-Based Machine Learning and Deep Learning Models for Real-Time Network Intrusion Detection","display_name":"Performance vs. Accuracy Trade-Off Analysis of Tree-Based Machine Learning and Deep Learning Models for Real-Time Network Intrusion Detection","publication_year":2026,"publication_date":"2026-11-10","ids":{"openalex":"https://openalex.org/W7225747638","doi":"https://doi.org/10.5281/zenodo.24098183"},"language":"en","primary_location":{"id":"doi:10.5281/zenodo.24098183","doi":"https://doi.org/10.5281/zenodo.24098183","is_oa":true,"landing_page_url":"https://doi.org/10.5281/zenodo.24098183","pdf_url":null,"source":{"id":"https://openalex.org/S4306400562","display_name":"Zenodo (CERN European Organization for Nuclear Research)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I67311998","host_organization_name":"European Organization for Nuclear Research","host_organization_lineage":["https://openalex.org/I67311998"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"volume":null,"type":"preprint","is_traditional":true,"indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.5281/zenodo.24098183","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5161410606","display_name":"Aditya Sunil Rane","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I157117621","display_name":"Kavayitri Bahinabai Chaudhari North Maharashtra University","ror":"https://ror.org/04g7tnd56","country_code":"IN","type":"education","lineage":["https://openalex.org/I157117621"]}],"countries":["IN"],"is_corresponding":true,"raw_author_name":"Rane, Aditya Sunil","raw_affiliation_strings":["Kavayitri Bahinabai Chaudhari North Maharashtra University"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Kavayitri Bahinabai Chaudhari North Maharashtra University","institution_ids":["https://openalex.org/I157117621"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":["https://openalex.org/A5161410606"],"corresponding_institution_ids":["https://openalex.org/I157117621"],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9262999892234802,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9262999892234802,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12326","display_name":"Network Packet Processing and Optimization","score":0.07020000368356705,"subfield":{"id":"https://openalex.org/subfields/1708","display_name":"Hardware and Architecture"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11598","display_name":"Internet Traffic Analysis and Secure E-voting","score":0.0008999999845400453,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7548999786376953},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.7063999772071838},{"id":"https://openalex.org/C108583219","wikidata":"https://www.wikidata.org/wiki/Q197536","display_name":"Deep learning","level":2,"score":0.652400016784668},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.6259999871253967},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.5796999931335449},{"id":"https://openalex.org/C50644808","wikidata":"https://www.wikidata.org/wiki/Q192776","display_name":"Artificial neural network","level":2,"score":0.48660001158714294},{"id":"https://openalex.org/C31395832","wikidata":"https://www.wikidata.org/wiki/Q1318674","display_name":"Testbed","level":2,"score":0.4587000012397766},{"id":"https://openalex.org/C2780513914","wikidata":"https://www.wikidata.org/wiki/Q18210350","display_name":"Bottleneck","level":2,"score":0.37940001487731934},{"id":"https://openalex.org/C78766204","wikidata":"https://www.wikidata.org/wiki/Q555032","display_name":"Multi-core processor","level":2,"score":0.367000013589859},{"id":"https://openalex.org/C43521106","wikidata":"https://www.wikidata.org/wiki/Q2165493","display_name":"Pipeline (software)","level":2,"score":0.3490000069141388},{"id":"https://openalex.org/C82876162","wikidata":"https://www.wikidata.org/wiki/Q17096504","display_name":"Latency (audio)","level":2,"score":0.3472999930381775},{"id":"https://openalex.org/C81363708","wikidata":"https://www.wikidata.org/wiki/Q17084460","display_name":"Convolutional neural network","level":2,"score":0.34549999237060547},{"id":"https://openalex.org/C34736171","wikidata":"https://www.wikidata.org/wiki/Q918333","display_name":"Preprocessor","level":2,"score":0.33629998564720154},{"id":"https://openalex.org/C115537543","wikidata":"https://www.wikidata.org/wiki/Q165596","display_name":"Cache","level":2,"score":0.3246000111103058},{"id":"https://openalex.org/C157764524","wikidata":"https://www.wikidata.org/wiki/Q1383412","display_name":"Throughput","level":3,"score":0.30730000138282776},{"id":"https://openalex.org/C169258074","wikidata":"https://www.wikidata.org/wiki/Q245748","display_name":"Random forest","level":2,"score":0.30550000071525574},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.2912999987602234},{"id":"https://openalex.org/C86251818","wikidata":"https://www.wikidata.org/wiki/Q816754","display_name":"Benchmarking","level":2,"score":0.29109999537467957},{"id":"https://openalex.org/C190502265","wikidata":"https://www.wikidata.org/wiki/Q17069496","display_name":"MNIST database","level":3,"score":0.28600001335144043},{"id":"https://openalex.org/C149810388","wikidata":"https://www.wikidata.org/wiki/Q5374873","display_name":"Emulation","level":2,"score":0.27649998664855957},{"id":"https://openalex.org/C74193536","wikidata":"https://www.wikidata.org/wiki/Q574844","display_name":"Kernel (algebra)","level":2,"score":0.2745000123977661},{"id":"https://openalex.org/C206729178","wikidata":"https://www.wikidata.org/wiki/Q2271896","display_name":"Scheduling (production processes)","level":2,"score":0.2741999924182892}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.5281/zenodo.24098183","doi":"https://doi.org/10.5281/zenodo.24098183","is_oa":true,"landing_page_url":"https://doi.org/10.5281/zenodo.24098183","pdf_url":null,"source":{"id":"https://openalex.org/S4306400562","display_name":"Zenodo (CERN European Organization for Nuclear Research)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I67311998","host_organization_name":"European Organization for Nuclear Research","host_organization_lineage":["https://openalex.org/I67311998"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},{"id":"doi:10.5281/zenodo.24098184","doi":"https://doi.org/10.5281/zenodo.24098184","is_oa":true,"landing_page_url":"https://doi.org/10.5281/zenodo.24098184","pdf_url":null,"source":{"id":"https://openalex.org/S4306400562","display_name":"Zenodo (CERN European Organization for Nuclear Research)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I67311998","host_organization_name":"European Organization for Nuclear Research","host_organization_lineage":["https://openalex.org/I67311998"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"doi:10.5281/zenodo.24098183","doi":"https://doi.org/10.5281/zenodo.24098183","is_oa":true,"landing_page_url":"https://doi.org/10.5281/zenodo.24098183","pdf_url":null,"source":{"id":"https://openalex.org/S4306400562","display_name":"Zenodo (CERN European Organization for Nuclear Research)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I67311998","host_organization_name":"European Organization for Nuclear Research","host_organization_lineage":["https://openalex.org/I67311998"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"sustainable_development_goals":[],"study_designs":[],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Background":[0],"&":[1],"Problem":[2],"Statement:":[3],"Modern":[4],"enterprise":[5],"networks":[6],"operate":[7],"across":[8,141,174],"rapidly":[9],"expandingattack":[10],"surfaces,":[11],"driving":[12],"the":[13,72,81,181,194,242,287,304,353,358],"transition":[14],"from":[15,333],"static":[16,90],"signature-based":[17],"Network":[18],"Intrusion":[19],"Detection":[20],"Systems(NIDS)":[21],"to":[22,180,230,336],"Machine":[23],"Learning":[24,28],"(ML)":[25],"and":[26,35,47,76,110,112,121,204,213,224,265,271,313,327,349],"Deep":[27],"(DL)":[29],"flow":[30],"classifiers.":[31],"Although":[32],"deep":[33],"neuralnetworks":[34],"large":[36],"gradient-boosted":[37],"ensembles":[38],"achieve":[39],"near-perfect":[40],"offline":[41],"classification":[42],"scores,":[43],"theirhigh":[44],"computational":[45],"complexity":[46],"memory":[48],"footprints":[49],"risk":[50],"inducing":[51],"severe":[52],"processing":[53],"bottlenecks":[54],"andpacket":[55],"drops":[56],"under":[57],"strict":[58],"multi-gigabit":[59],"line-rate":[60],"Service":[61],"Level":[62],"Agreements":[63],"(<":[64],"1.0":[65,367],"ms":[66,219,248,254,293,299,302,368],"per":[67],"flow).Methodology:":[68],"This":[69],"thesis":[70],"introduces":[71],"Unified":[73],"Dual-Fidelity":[74],"Benchmarking":[75],"Pareto-OptimizationFramework":[77],"(UDBF-NIDS)":[78],"evaluated":[79],"on":[80,148],"2,830,743-flow":[82],"CICIDS2017":[83],"dataset.":[84],"A":[85],"leakage-free":[86],"preprocessing":[87],"pipeline":[88],"strips":[89],"socket":[91],"identifiers,":[92],"enforces":[93],"a":[94,149,217,280,291,340,345],"70/15/15":[95],"stratified":[96],"split,":[97],"applies":[98],"trainingfitted":[99],"Robust":[100],"Scaling,":[101],"selects":[102],"34":[103],"non-collinear":[104],"features":[105],"via":[106,116],"Spearman":[107],"rank":[108],"correlation":[109],"Tree-SHAPattribution,":[111],"mitigates":[113],"class":[114],"imbalance":[115],"SMOTE+Tomek":[117],"Links,":[118],"class-balanced":[119],"weighting,":[120],"Focal":[122],"Loss.":[123],"Four":[124],"tree-based":[125],"estimators":[126],"(CART":[127],"Decision":[128,334,355],"Tree,":[129],"Random":[130],"Forest,":[131],"XGBoost,":[132],"LightGBM)":[133],"andtwo":[134],"DL":[135,172],"architectures":[136,173],"(MLP,":[137],"1D-CNN)":[138],"are":[139],"benchmarked":[140],"424,152":[142],"holdout":[143],"test":[144],"flows":[145],"spanning":[146],"15classes":[147],"single-threaded":[150],"Intel":[151],"Core":[152],"i5-8265U":[153],"CPU":[154,231],"testbed":[155],"using":[156],"nanosecond":[157],"performance":[158],"countersand":[159],"micro-batched":[160],"(B":[161],"=":[162],"1,024)":[163],"throughput":[164,228,307,351],"profiling.Key":[165],"Empirical":[166],"Findings:":[167],"Tree-based":[168],"models":[169],"decisively":[170],"outperformed":[171],"overalland":[175],"minority":[176,209],"attack":[177],"categories":[178],"due":[179,229],"inductive":[182],"bias":[183],"mismatch":[184],"of":[185,269,363],"continuous":[186],"neural":[187],"projections":[188],"onheterogeneous":[189],"tabular":[190],"telemetry.":[191],"XGBoost":[192,337],"achieved":[193,252,279],"highest":[195,288,305],"detection":[196],"fidelity":[197],"with":[198,261],"0.998654":[199],"accuracy,":[200],"0.998649":[201],"weighted":[202,262,282,319,325,342],"F1-score,":[203,283,286],"0.862091":[205],"macro":[206,285],"F1-score\u2014including":[207],"top":[208],"F1-scoreson":[210],"Infiltration":[211],"(0.500000)":[212],"Heartbleed":[214],"(1.000000)\u2014but":[215],"incurred":[216],"3.035580":[218],"(3,035.58":[220],"\u00b5s)":[221,295],"meansingle-sample":[222],"latency":[223,245,297,347],"9,966.58":[225],"samples/s":[226],"batch":[227,306],"L3":[232],"cache":[233],"evictions":[234],"across4,500":[235],"trees":[236],"(10.49":[237],"MB).":[238],"Conversely,":[239],"MLP":[240],"recorded":[241],"lowest":[243],"mean":[244,296],"at":[246,308,344],"0.116416":[247],"(116.42":[249],"\u00b5s)and":[250],"1D-CNN":[251,328],"0.297770":[253],"(297.77":[255],"\u00b5s),":[256],"yet":[257],"both":[258],"failed":[259],"operationally":[260],"F1-scoresof":[263],"0.764465":[264],"0.737203":[266],"(macro":[267],"F1":[268],"0.286097":[270],"0.147556).":[272],"The":[273],"cache-resident":[274],"CART":[275],"DecisionTree":[276],"(0.46":[277],"MB)":[278],"0.997430":[281],"0.792267":[284],"balancedaccuracy":[289],"(0.848016),":[290],"0.125687":[292],"(125.69":[294],"(0.236430":[298],"P95,":[300],"0.4170":[301],"maximum),and":[303],"2,698,884.72":[309],"samples/s.Conclusion:":[310],"Multi-objective":[311],"Pareto":[312],"queueing-theoretical":[314],"analyses":[315],"eliminate":[316],"RandomForest(10.287557ms,":[317],"0.996382":[318],"F1),":[320,326],"LightGBM":[321],"(1.198944":[322],"ms,":[323],"0.344702":[324],"as":[329],"strictlydominated.":[330],"Because":[331],"transitioning":[332],"Tree":[335,356],"yields":[338],"only":[339],"+0.001219":[341],"F1gain":[343],"24.15-fold":[346],"penalty":[348],"270.79-fold":[350],"reduction,":[352],"single":[354],"represents":[357],"sole":[359],"Pareto-optimal":[360],"architecture":[361],"capable":[362],"sustaining":[364],"deterministic":[365],"<":[366],"inline":[369],"line-rateinspection":[370],"without":[371],"ingress":[372],"queue":[373],"saturation":[374]},"counts_by_year":[],"updated_date":"2026-11-11T12:16:26.678958","created_date":"2026-11-11T00:00:00"}