Analisis Perbandingan CNN, SVM, dan Hybrid CNN-SVM untuk Deteksi Anomali Trafik Jaringan

Abstract

The rapid growth of information technology has significantly increased the volume and complexity of network traffic, leading to cyber security threats that are increasingly dynamic and difficult to detect using traditional security systems. The limitations of signature-based detection systems in identifying new attacks, including zero-day attacks, necessitate the adoption of more adaptive anomaly detection approaches through the utilization of machine learning and deep learning within Network Intrusion Detection Systems (NIDS). This study aims to analyze and compare the performance of Convolutional Neural Networks (CNN), Support Vector Machines (SVM), and a hybrid CNN–SVM model in detecting network traffic anomalies. This research employs a quantitative approach using an experimental method to evaluate the performance of the three models based on the CIC-IDS2017 dataset. The experimental process includes data preprocessing, model development, and performance evaluation using accuracy, precision, recall, F1-score, and confusion matrix metrics. The results indicate that the CNN and SVM baseline models achieve high accuracy levels of 98.85% and 98.66%, respectively, but still exhibit limitations in detecting minority attack classes. The hybrid CNN–SVM model achieves the best performance with an accuracy of 99.41% and a more balanced macro-average recall, indicating improved generalization across classes. The integration of CNN as a feature extractor and SVM as a classifier is proven to be effective in leveraging the complexity of network traffic features while enhancing classification stability. Therefore, the hybrid CNN–SVM approach can be recommended as a more effective and reliable network traffic anomaly detection method compared to single-model approaches in supporting modern network security systems.