A Multi-Class Supervised Neural Network Framework for Cyber Threat Classification in Telecommunications Traffic
Year: 2026
Type: conference-paper
Abstract: Telecommunication environments such as 5G and Internet of Things (IoT) networks generate massive, heterogeneous traffic that is increasingly difficult to protect with traditional signature-based intrusion detection systems. In this work we investigate supervised threat classification using the CIC-IDS-2017 dataset with a focus on realistic telecom scenarios, where high accuracy must be balanced with low false-positive rates and strict latency constraints. We design and evaluate a family of hybrid machine-learning and deep-learning models that combine classical algorithms (Random Forest, k-Nearest Neighbors, K-Means, Birch) with convolutional and fully connected neural architectures under a unified preprocessing and feature-engineering pipeline. The study compares alternative input representations, normalization schemes and class-balancing strategies, and reports detailed results for benign and attack classes that are critical for telecom operators, including DoS, DDoS, infiltration, web attacks and brute-force attempts. Experimental results show that the Random Forest plus deep neural network configuration achieves the best trade-off between macro-average F1-score, detection rate and computational cost, while preserving robustness under traffic imbalance and previously unseen flows. We further analyze feature importance and confusion patterns to explain typical misclassifications and to highlight the contribution of RF-based feature construction to the final neural classifier. The findings indicate that carefully engineered hybrid models can serve as an effective core for telecom-oriented intrusion detection and can be integrated into existing monitoring pipelines without prohibitive hardware upgrades. The paper concludes with practical recommendations for deploying the proposed architecture in real 5G and IoT infrastructures and outlines future work on online learning and transferability to newer intrusion detection datasets.
Institution: Astana IT University
Language: English
Subfield: Computer Networks and Communications
Field: Computer Science
Domain: Physical Sciences
Open Access status: hybrid
OpenAlex ID: W7203633033