A lightweight 1D convolutional neural network for malicious network traffic detection on heterogeneous benchmark datasets

The rise of advanced cyber threats is creating a need for automated, computationally optimized systems to identify malicious traffic across the network at scale. The available deep learning intrusion detection platforms often incur significant parameter overhead, and few tackle both the challenges of high-dimensional tabular flow features and extreme class imbalance in a single platform. This study proposes a one-dimensional convolutional neural network (1D CNN) that operates directly on tabular features represented as vectors, transforming them into spatially formatted input. The network consists of two convolutional layers with 32 and 16 filters, respectively, global average pooling, and a single sigmoid output node, yielding a compact network suitable for deployment on resource-constrained devices. A strict preprocessing pipeline manages data heterogeneity using correlation-based feature filtering, MinMax scaling, and one-hot encoding. A training strategy that is imbalance-aware combines inverse-frequency weighting of classes, conditional synthetic minority oversampling, and validation-based optimization of the decision threshold. The recommended framework is tested on two standard datasets, CSE-CIC-IDS2018 and UNSW-NB15. Binary detection achieved ROC-AUC scores of 0.9782 and 0.9990 on CSE-CIC-IDS2018 and UNSW-NB15, respectively, with corresponding balanced accuracies of 0.9497 and 0.9967. The supplementary multiclass experiment on CSE-CIC-IDS2018 with a small multilayer perceptron achieves 95.2% accuracy across 13 traffic types, with a macro-ROC-AUC of 0.9857 and only 55,053 trainable parameters, further indicating that the proposed preprocessing and training strategy is generally applicable. The findings underscore the feasibility of lightweight convolutional networks in network intrusion detection.