The Impact of Data Preprocessing and Training Regime on the Quality of Neural Network Classification of Network Traffic in the CICIDS2017 Dataset

The subject of this study is the impact of preprocessing statistical features and training regimes on the quality of binary classification of network traffic using fully connected neural networks. The relevance of this topic arises from the increasing volume of network traffic and the proliferation of encrypted connections, which complicate the analysis of packet contents. Under these conditions, attack detection increasingly relies on flow parameters that are accessible without decrypting the data. This paper examines ten features including connection duration, the number and sizes of packets, as well as the volume and intensity of transmission. Special attention is given to feature normalization, the influence of extreme values, and the frequency of weight updates under a constant model architecture. Classification quality is assessed using both random splits of the CICIDS2017 dataset and training and validation on data from different observation days. Comparative schemes illustrate the impact of the composition of test traffic on outcomes. A computational experiment was conducted on 57,004 CICIDS2017 flows after removing duplicates. Four neural network configurations, logistic regression, and decision trees were compared. Five random splits of 80/20 were applied, along with day-wise validation; performance metrics included accuracy, precision, recall, F1 score, and ROC AUC. In random splits, the application of mini-batches, logarithmic transformation, and standardization led to an increase in the neural network's F1 score from 0 to 0.953. The decision tree achieved an F1 score of 0.963, indicating that the neural network approach does not have an unconditional advantage. When trained on data from Monday to Wednesday and tested on flows from Thursday to Friday, the F1 score for configurations with logarithmic transformation decreased to 0.546, while the best performance of 0.737 was achieved by the network using Min-Max normalization and mini-batch training. The discrepancy between the F1-score and ROC AUC suggests that the selected classification threshold may affect attack detection performance. Within the examined CICIDS2017 subset, the preferred neural network configuration changed between random and day-based evaluation schemes. This methodological observation requires further validation using additional temporal splits and independent network traffic datasets.