## 1 Introduction  
With the rapid growth of digital connectivity and computational power, unauthorized network intrusions, commonly referred to as network attacks, have become increasingly frequent and sophisticated. These cyberattacks target vulnerabilities in network services to gain unauthorized access or disrupt operations, which ultimately endanger the operations of the entire Information Technology infrastructure [1]. Overall, the surge in network-based threats has led to a notable rise in both the scale and complexity of cyber incidents worldwide [1,2]. Recent statistics highlight the severity of this trend: in 2024, over 6.5 billion malware attacks were recorded globally, and the average cost of a data breach reachedUSD 4.88 million [2; 3]. In the United States alone, the average breach cost in 2023 was approximately USD 9 million, while the global average consistently hovers around USD 4 million [2; 3]. On the other hand, according to Figure 1, it is evident that the estimated annual cost of cybercrime worldwide is projected to reach over USD 13 trillion by 2028, making it one of the most economically damaging threats globally and surpassing the value of the global trade of all major illegal drugs combined [1; 2]. Hence, these figures underscore the critical need for robust, intelligent cybersecurity solutions to protect sensitive digital infrastructure. Overall, network attacks are broadly categorized into two main types: active attacks and passive attacks where active attacks involve direct system intrusions carried out using malware, viruses, trojans, or other exploitation tools [3; 4; 5]. Previously seen as minor threats posed by amateur hackers, these attacks have evolved in scale and impact, now affecting billions of users globally and resulting in estimated damages exceeding USD 2.7 billion between 2021 and 2023 [1; 2; 3]. Nonetheless, annual network security revenue is projected to grow significantly, increasing from approximately USD 20 billion in 2016 to over USD 60 billion by 2028 (as depicted in Figure 2), driven by rising cyber threats, increased adoption of cloud services, and stricter regulatory compliance requirements. On the contrary, passive attacks involve the covert monitoring of data transmissions to intercept unencrypted credentials or sensitive information [5; 6; 7]. These attacks do not alter system resources but pose significant risks by compromising data confidentiality without detection. Figure 3 showcases commonly observed cyberattacks, including Denial  
Figure 1: Estimated annual cost of cybercrime worldwide (in trillion US dollars). Figure 2: Annual network security revenue (in billion US dollars) (2016–2028). of Service (DoS) and Distributed Denial of Service (DDoS) attacks, Man-in-the-Middle attacks, packet sniffing, port scanning, and ARP spoofing [2; 3]. Traditional security defenses relying on static rule sets and manual log analysis are increasingly ineffective against evolving cyber threats [8; 9; 10; 11; 12]. Manual monitoring is labor-intensive and inherently reactive, often detecting breaches only after significant damage has occurred. To overcome these limitations, modern intrusion detection systems (IDSs) have begun leveraging machine learning (DL) to enable proactive, real-time threat detection [12; 13; 14; 15; 16]. While classical IDS approaches were effective in early network environments, they struggle in modern contexts due to several critical limitations:  
1. Increased attack complexity: Modern threats such as Distributed Denial of Service (DDoS) and polymorphic malware evolve rapidly, often bypassing static, pattern-based detection methods [4]. 2. Scalability challenges: The high volume and velocity of traffic in enterprise and cloud environments overwhelm traditional IDS infrastructures [3; 4]. 3. Limited adaptability: Fixed-pattern classifiers are incapable of identifying novel or zero-day attacks not represented in the training data [4; 5; 6; 7].