Investigation of the performance of deep learning based regression problems

The increasing volume of network traffic and the emergence of evolving zero-day attacks have reduced the effectiveness of traditional classification-based intrusion detection systems that rely heavily on labeled data. This thesis proposes a deep learning-based regression architecture that approaches anomaly detection as a prediction problem rather than a classification task. The proposed framework models the normal behavior of network traffic and predicts the amount of transmitted data. The main hypothesis is that the system can establish a mathematical reference by learning only normal traffic patterns, while deviations from this reference can be identified as cyberattacks using the Three-Sigma rule and the PR-F2 thresholding method. The Internet Firewall dataset was used in this study. During the data preprocessing stage, logarithmic transformation was applied to positively skewed variables, and all input features were subsequently standardized. The models were trained exclusively on normal traffic data, whereas both normal and attack records were utilized during the validation and testing phases. Linear Regression, Ridge Regression,SVR Multilayer Perceptron, 1D-CNN, and Autoencoder-based regression models were implemented and compared. Model performances were first evaluated using regression metrics, and anomaly detection was then performed through thresholding techniques based on prediction errors, namely the Three-Sigma rule and the PR-F2 method. The experimental results demonstrated that superior regression performance does not necessarily translate into superior anomaly detection capability. Although SVR achieved competitive results in certain evaluation metrics, the 1D-CNN produced more balanced and stable performance in both regression and anomaly detection tasks. Its consistent performance across different thresholding methods indicates its effectiveness in capturing complex traffic patterns. Overall, the findings suggest that prediction error-based thresholding can serve as an effective decision-support mechanism for network security applications.