A Leakage-Free Deep Neural Network Framework for Network Intrusion Detection Using Gini Importance Feature Selection

Modern Network Intrusion Detection Systems (NIDS) face critical performance bottlenecks due to high feature dimensionality, data redundancy, and the risk of data leakage caused by administrative attributes. To overcome these limitations, this paper presents an optimized, leakage-free Deep Neural Network (DNN) framework for binary network threat classification evaluated on the comprehensive UNSW_NB15 benchmark dataset. To prevent synthetic model memorization and reduce computational complexity, explicit identifier fields and category labels (id, attack_cat) were strictly dropped. Feature dimensionality was reduced by deploying a Gini-based Random Forest feature selection strategy to isolate the top 30 most impactful network features (including proto, ct_dst_ltm, sjit, and dtcpb). The reduced feature space was normalized using a fitted StandardScaler and processed through a 3-stage hidden layer DNN architecture (128→64→32 neurons) equipped with Batch Normalization, Dropout regularization, and balanced class weights to handle class imbalance. Evaluated across 175,341 unseen test network packets, the proposed model achieved an overall Accuracy of 93.93%, a Precision of 94.16%, a Recall of 93.93%, and an F1-Score of 93.99%. Detailed confusion matrix analysis reveals high class-wise detection rates, successfully capturing 111,905 actual attack packets (93.77% Sensitivity) and 52,792 normal traffic instances (94.27% Specificity) while limiting false positives to 3,208 instances (5.73%). Furthermore, the model exhibited exceptional discrimination capability with a Receiver Operating Characteristic Area Under Curve (ROC-AUC) of 0.9900 and an Average Precision (AP) score of 0.9953 on the Precision-Recall curve. The experimental findings validate that combining targeted Gini feature selection with a regularized deep learning architecture delivers a highly robust, computationally efficient, and deployment-ready solution for real-time cyber threat detection in enterprise network environments.