A Comparative Evaluation of Standalone and Hybrid Machine Learning Techniques for Network Anomaly Detection Using NSL-KDD

Abstract

Results of network anomaly detection in a controlled environment can be persuasive but often fail to perform with new, unseen network traffic. This study investigates four standalone machine learning models, namely Random Forest (RF), Decision Tree (DT), Support Vector Machine (SVM), Neural Network (NN), and four hybrid models, which include SVM + RF, K-Means + RF, NN + RF, and K-Means + NN. These models are studied using both stratified 10-fold validation and KDDTest+ subset evaluation. This study investigates not only which model performs best but also assesses whether a hybrid model design provides a measurable advantage over standalone models. An identical processing procedure was applied to all models. The procedure includes one-hot encoding, normalization, and stratified 10-fold cross-validation, followed by final evaluation with the KDDTest+ subset. SVM + RF hybrid reported the highest accuracy of 84.08% and precision of 0.9716. In contrast, the standalone Neural Network outperformed the other models with a recall score of 0.7522 and an F1-score of 0.8425, which indicates better detection coverage performance. Relative to the standalone SVM baseline, SVM + RF achieved relative improvements of 1.01% in accuracy and 2.13% in precision. Standalone NN demonstrated a precision-recall trade-off with 1.36% higher recall over the top hybrid model. Overall, the findings show that hybrid models can perform better for the selected metrics, but do not guarantee consistent superiority. For deployment, model choice should be guided by the operational priority of the intrusion detection system, particularly the trade-off between reducing false alarms and detecting more attacks.