Functional Evaluation of a CNN-Based Network Intrusion Monitoring Framework Integrating Zeek, Snort, Elasticsearch, and Django

Offline benchmark performance does not establish that an intrusion classifier can operate reliably within a live monitoring workflow. This study evaluates the functional deployment and deployment readiness of a convolutional neural network (CNN)-based network intrusion monitoring prototype integrating Ubuntu virtual machines, Zeek and Snort, Elasticsearch, a saved 1D-CNN with serialized feature-selection and scaling artefacts, and a Django administrator interface. The prototype was examined as an end-to-end system rather than as an isolated classifier. Functional evidence was assessed across model loading, manual prediction, CSV-based testing, Elasticsearch retrieval, periodic live-table refresh, and benign/suspicious visualization. A code-level audit then compared training-time and deployment-time feature schemas, preprocessing, input types, and decision rules. The implementation demonstrates a working monitoring workflow from network telemetry to administrator-facing classification. However, the documented live routine constructs four Zeek-derived model-facing fields before invoking a selector fitted on a 23-feature preselection vector, protocol encoding is not clearly aligned with the numeric representation used during training, manual and CSV routes expose inconsistent feature definitions, and the deployed decision threshold of 0.1 differs from the 0.5 threshold used in offline evaluation. The available records also do not contain labelled live-traffic accuracy, end-to-end latency, throughput, CPU usage, memory usage, dropped-event rate, or alert delay. Consequently, the evidence supports functional implementation and architectural feasibility, but not quantitative real-time effectiveness. The study contributes an auditable deployment architecture, identifies the feature-schema mismatch as the principal technical constraint, and specifies a targeted validation protocol based on labelled replay, stage-level latency instrumentation, throughput stress testing, resource profiling, and consistent inference-path regression tests. These results establish the measurements and corrections required before stronger real-time claims can be justified.

deployment validation, network intrusion detection, 1D-CNN, Zeek and Elasticsearch

1. Aburomman, A. A., Alakhras, M., & Reaz, M. B. I. (2026). Leakage-safe IoT intrusion detection with White Shark Optimizer-based feature selection. Array, 30, 100903. [Google Scholar] [Crossref]

2. https://doi.org/10.1016/j.array.2026.100903 [Google Scholar] [Crossref]

3. Ahmad, Z., Khan, A. S., Shiang, C. W., Abdullah, J., & Ahmad, F. (2021). Network intrusion detection system: A systematic study of machine learning and deep learning approaches. Transactions on Emerging Telecommunications Technologies, 32(1), e4150. https://doi.org/10.1002/ett.4150 [Google Scholar] [Crossref]

4. Anwar, R. W., Abrar, M., Salam, A., & Ullah, F. (2026). A lightweight 1D convolutional neural network for malicious network traffic detection on heterogeneous benchmark datasets. Array, 30, 100925. https://doi.org/10.1016/j.array.2026.100925 [Google Scholar] [Crossref]

5. Apruzzese, G., Pajola, L., & Conti, M. (2022). The cross-evaluation of machine learning-based network intrusion detection systems. IEEE Transactions on Network and Service Management, 19(4), 5152-5169. https://doi.org/10.1109/TNSM.2022.3157344 [Google Scholar] [Crossref]

6. Bertoli, G. C., Pereira Junior, L. A., Saotome, O., dos Santos, A. L., Verri, F., Marcondes, C., Barbieri, S., Rodrigues, M. S., & de Oliveira, J. M. P. (2021). An end-to-end framework for machine learning-based network intrusion detection system. IEEE Access, 9, 106790-106805. [Google Scholar] [Crossref]

7. https://doi.org/10.1109/ACCESS.2021.3101188 [Google Scholar] [Crossref]

8. Chou, D., & Jiang, M. (2021). A survey on data-driven network intrusion detection. ACM Computing Surveys, 54(9), Article 182. https://doi.org/10.1145/3472753 [Google Scholar] [Crossref]

9. Kim, A., Park, M., & Lee, D. H. (2020). AI-IDS: Application of deep learning to real-time web intrusion detection. IEEE Access, 8, 70245-70261. https://doi.org/10.1109/ACCESS.2020.2986882 [Google Scholar] [Crossref]

10. Le Jeune, L., Goedeme, T., & Mentens, N. (2021). Towards real-time deep learning-based network intrusion detection on FPGA. In Applied Cryptography and Network Security Workshops (pp. 133-150). Springer. https://doi.org/10.1007/978-3-030-81645-2_9 [Google Scholar] [Crossref]

11. Maasaoui, Z., Merzouki, M., Battou, A., & Lbath, A. (2025). A scalable framework for real-time network security traffic analysis and attack detection using machine and deep learning. Platforms, 3(2), 7. https://doi.org/10.3390/platforms3020007 [Google Scholar] [Crossref]

12. Magán-Carrión, R., Urda, D., Díaz-Cano, I., & Dorronsoro, B. (2020). Towards a reliable comparison and evaluation of network intrusion detection systems based on machine learning approaches. Applied Sciences, 10(5), 1775. https://doi.org/10.3390/app10051775 [Google Scholar] [Crossref]

13. Mo, Y., Li, H., Wang, D., & Liu, G. (2024). An intrusion detection system based on convolution neural network. PeerJ Computer Science, 10, e2152. https://doi.org/10.7717/peerj-cs.2152 [Google Scholar] [Crossref]

14. Mohammadpour, L., Ling, T. C., Liew, C. S., & Aryanfar, A. (2022). A survey of CNN-based network intrusion detection. Applied Sciences, 12(16), 8162. https://doi.org/10.3390/app12168162 [Google Scholar] [Crossref]

15. Qazi, E. H., Almorjan, A., & Zia, T. A. (2022). A one-dimensional convolutional neural network (1D-CNN) based deep learning system for network intrusion detection. Applied Sciences, 12(16), 7986. https://doi.org/10.3390/app12167986 [Google Scholar] [Crossref]

16. Racherla, S., Sripathi, P., Faruqui, N., Kabir, M. A., Whaiduzzaman, M., & Shah, S. A. (2024). Deep-IDS: A real-time intrusion detector for IoT nodes using deep learning. IEEE Access, 12, 63584-63597. https://doi.org/10.1109/ACCESS.2024.3396461 [Google Scholar] [Crossref]

17. Shreya, M., Jain, S., Shetty, S., Kumar, S. A., & Narasimha Swamy, S. (2026). Low-latency streaming-based network intrusion detection system. International Journal of Networked and Distributed Computing. Advance online publication. https://doi.org/10.1007/s44227-026-00112-4 [Google Scholar] [Crossref]

• What the Desert Fathers Teach Data Scientists: Ancient Ascetic Principles for Ethical Machine-Learning Practice
• Comparative Analysis of Some Machine Learning Algorithms for the Classification of Ransomware
• Comparative Performance Analysis of Some Priority Queue Variants in Dijkstra’s Algorithm
• Transfer Learning in Detecting E-Assessment Malpractice from a Proctored Video Recordings.
• Dual-Modal Detection of Parkinson’s Disease: A Clinical Framework and Deep Learning Approach Using NeuroParkNet