محمد حسين

Network intrusion detection systems face significant challenges when dealing with imbalanced datasets where benign traffic vastly outnumbers attacks, an‎d rare attack types have minimal representation. Traditional deep learning approaches struggle with this imbalance, often achieving high overall accuracy while failing to detect minority class attacks. This research addresses these challenges through a two-stage hierarchical architecture that combines fuzzy logic with deep neural networks. The proposed system employs a Guardian Filter in the first stage, using an ensemble of 100 decision trees to efficiently separate benign traffic from suspicious flows. This filtering removes 84% of benign samples while maintaining 98.9% attack recall, reducing computational overhead for subsequent processing. The second stage applies fuzzy preprocessing to transform 54 numerical features into 270 fuzzy membership values across five linguistic categories (Very Low, Low, Medium, High, Very High), followed by classification through a deep neural network with progressive dro‎pout regularization. eva‎luation on the CICIDS2017 dataset demonstrates the systemʹs effectiveness across multiple metrics. Overall accuracy reached 99.86% with a macro F1-score of 95.85%, representing a 10.54% improvement over single-stage baselines. Performance on minority classes proves particularly strong, with the Infiltration class (0.006% preva‎lence) achieving an F1-score of 0.8889—a 55-point improvement over flat classification approaches. The system maintained zero false positives across all attack categories. The research validates several key contributions. First, hierarchical decomposition effectively addresses conflicting optimization objectives in imbalanced classification by separating coarse filtering from fine-grained discrimination. Second, fuzzy transformation enhances minority class detection by expan‎ding feature representation to capture uncertainty patterns that numerical values alone cannot express. Third, class-specific augmentation strategies—SMOTE-ENN for extremely rare attacks an‎d WGAN-GP for moderately imbalanced classes—prove more effective than uniform oversampling. Fourth, SHAP analysis confirms the model learns domain-relevant features rather than spurious correlations. These results establish that integrating fuzzy logic with hierarchical deep learning offers an effective approach to intrusion detection in severely imbalanced environments.

تشخيص نفوذ , يادگيري عميق، , منطق فازي , {

Intrusion detection , deep learning , fuzzy logic , network security

Mohammed. k. Hussein

Dr. Hassan Naderi