A Comparative Analysis of Logistic Regression and Random Forest for Intrusion Detection Systems: A Reproducible, Deployment-Oriented Study

Intrusion Detection Systems (IDS) must deliver high detection rates with controllable false alarms under class imbalance, non-stationarity, and strict latency constraints.We present a rigorous, end-toend comparison of Logistic Regression (LR) and Random Forest (RF) for IDS, emphasizing reproducibility, statistical validity, and deployability.Using standard benchmark datasets (NSL-KDD for tabular network connections; BoT-IoT and TON_IoT for modern IoT traffic), we build a unified pipeline covering feature preprocessing, class-imbalance mitigation, hyperparameter tuning, threshold calibration, and uncertainty-aware evaluation.Results show that RF consistently achieves higher recall and F1 on attack classes, especially under heterogeneous traffic, while LR offers superior interpretability and competitive precision when calibrated.We quantify operating regimes where LR is preferable (auditable environments, tight latency, scarce features) and where RF dominates (nonlinear patterns, richer features).We release a full protocol-metrics, statistical tests, ablations, and deployment guidelines-to enable reproducible benchmarking and practical adoption.