Aludhilu, Hilma Ndapewa2022-07-212022-07-212020http://hdl.handle.net/11070/3225A thesis submitted in partial fulfillment of the requirements for the Degree of Master of Science (Information Technology)Computer network technologies have grown speedily in the last decade and they are susceptible to numerous intrusions. Recently, Deep Leaming methodologies for example Recurrent Neural Networks have been the new trend for building Intrusion Detection System (IDS). However, Recurrent Neural Network (RNN) IDS can be biased, as datasets from real-world production networks are mostly not used during the training of IDSs. The purpose of this study is to develop an IDS using RNN with two datasets from real-world networks and one synthetic dataset. The study aims to create a dataset from real-world network traffic, train an RNN model and test the corresponding IDS using several datasets: from real-world networks (Kyoto and UNAM datasets) and also synthetic (NLS-KDD dataset). Finally, the performance of the RNN-IDS is evaluated. A quantitative research design, with the experimental approach, is used for this study. An experiment is carried out to compare several RNN architectures: basic RNN, LSTM and GRU, offering insight into how the RNN architectures perform when trained and tested with real-world and synthetic datasets. The results of the study show that the GRU model outperformed other RNN architectures with an accuracy score of 95% using the real-world datasets and 97% using the synthetic dataset. The study concludes that the GRU model performs well with real-world datasets. Furthermore, the study recommends finding methods to solve the imbalance of classes in real-world datasets, without turning the data into synthetic data. It is also recommended to consider the environment in which the IDS will work in, before choosing the best model to be used.enComputer network technologiesRecurrent neural networkThesis