Autoencoder Versus CNN-1D for Network Traffic Intrusion Detection: A Reproducible Comparative Evaluation with Per-Class Analysis on CSE-CIC-IDS2018

Comparisons between deep learning models for network intrusion detection are hard to attribute to the architectures themselves because reported scores also absorb differences in preprocessing, partitioning, and configuration. This study holds all of those constants and asks what is left. A deep autoencoder and a one-dimensional convolutional network were evaluated on identical stratified splits of 11.3 million labeled flows from CSE-CIC-IDS2018, and the two configuration decisions the pipeline forces on the practitioner, the anomaly threshold, and the class weighting scheme, were then varied in isolation. The supervised model outperformed the reconstruction-based one by a wide margin on binary detection, but the configuration decisions proved more consequential than the choice of architecture. Moving the autoencoder threshold changed its reported F1 by 0.1279 while its ranking ability remained unchanged, and removing the class weighting of the multiclass model changed macro F1 by 0.1408, an order of magnitude more than the run-to-run variability of the same pipeline. The 38.1% of benign traffic misclassified as Infiltration, the most conspicuous result of the study, is an artefact of the weighting rather than the attack class or the data and expresses a trade-off between alert volume and infiltration coverage. An aggregate score can therefore remain stable while the operational behavior it summarizes changes by a third, which makes the calibration criterion, the imbalance strategy, and the variance across seeds preconditions for any meaningful comparison.