Cost-Aware Lightweight Deep Learning for Intrusion Detection: A Comparative Study on UNSW-NB15 and CIC-IDS2017

Lightweight intrusion detection systems (IDSs) are increasingly integrated into applied data science workflows for cybersecurity and process monitoring, where limited computational resources and asymmetric error costs constrain model design. This paper presents a comparative study of two lightweight deep learning IDS architectures: ForNet, a convolutional model optimized for feature-centric detection, and SigNet, a gated recurrent model designed for sequence-oriented modeling of ordered flow-feature representations. Both models are trained with Cost-Robust Focal Loss (CRF-Loss), a cost-aware objective that penalizes false positives and false negatives according to deployment-specific risk preferences. We evaluate the models on the UNSW-NB15 and CIC-IDS2017 benchmarks using six standard metrics (accuracy, precision, recall, F1-score, Matthews correlation coefficient (MCC), and the area under the receiver operating characteristic curve (AUROC)), complemented by an analysis of false-positive behavior. On CIC-IDS2017, ForNet achieves precision up to 0.95 and MCC up to 0.93 with AUROC above 0.94, while SigNet shows a stronger recall-oriented profile on UNSW-NB15. In an ablation study, replacing Binary Cross-Entropy with CRF-Loss reduces the false-positive rate by approximately 15–20% and improves robustness-oriented metrics such as MCC by up to 12% on CIC-IDS2017. Rather than claiming universal state-of-the-art performance, the study focuses on performance–risk trade-offs under realistic operational constraints. The results highlight how architectural bias and cost-aware optimisation jointly shape IDS behaviour and offer benchmark-based guidance for interpreting performance–risk trade-offs in lightweight intrusion detection.