## 1 Introduction  
In recent years, the rapid advancement of information technology and the widespread adoption of the internet have transformed how people live and work [1]. Digital technologies have become essential in various aspects of life, ranging from e-commerce [2] and social media [3] to telemedicine and remote work [4]. However, this digital transformation [5] has also heightened the vulnerability of computer networks to cyber threats, including unauthorized access, data breaches, and other malicious activities [6]. Cybercriminals continuously develop new techniques and strategies to exploit network vulnerabilities, posing serious risks to individuals, businesses, and governments worldwide [7, 8, 9]. As a result, the demand for effective intrusion detection systems (IDS) capable of identifying and mitigating cyberattacks in real time has increased [10]. Traditional IDS primarily rely on rule-based or signature-based approaches to detect known threats [11]. These methods function by comparing network traffic patterns against a database of predefined attack signatures or rules describing malicious activities. While signature-based IDS have proven effective against previously identified threats, they often struggle to detect novel or sophisticated attacks that do not conform to existing patterns [12]. Moreover, rule-based methods frequently generate a high number of false positives, increasing operational burdens and reducing efficiency in network security management [13]. Rule-based intrusion detection systems (IDSs) frequently experience high false positive rates because they depend on predefined signatures and rules, which struggle to adapt to emerging attack patterns. Research indicates that these systems often produce an overwhelming number of false alarms, straining security analysts and diminishing overall system efficiency [11,12]. Although signature-based IDS excel at detecting known threats, they struggle to identify zero-day attacks and emerging cyber threats. Consequently, they demonstrate a considerable detection gap when faced with sophisticated adversarial techniques [10,13]. Traditional IDS methods, including statistical anomaly detection and expert-defined heuristics, demand significant manual configuration and have difficulty adapting to evolving network environments. Recent studies suggest that these systems struggle to scale efficiently as network traffic complexity grows [14,15]. Recently, machine learning techniques have been extensively employed to enhance the accuracy, efficiency, and adaptability of intrusion detection systems (IDS) [16]. Unlike traditional rule-based approaches, which rely on static signatures and predefined rules, machine learning-based IDS analyze network traffic data dynamically [17]. These models can autonomously learn and distinguish patterns of normal and abnormal behavior, allowing them to detect previously unseen threats and adapt to evolving cyberattack strategies. However, the effectiveness of machine learning models is often constrained by the complexity of network traffic data and the dynamic nature of cyber threats [18]. High-dimensional network data with non-linear dependencies makes it challenging to extract meaningful features manually. Consequently, machine learning models require extensive feature engineering, a labor-intensive process that involves selecting relevant attributes, transforming raw data, and reducing dimensionality to optimize model performance. Despite these efforts, feature engineering may not always effectively capture the intricate relationships inherent in network traffic data, thereby limiting the model's generalization capabilities. Deep learning, a specialized subset of machine learning, has emerged as a powerful alternative capable of addressing these limitations.