Jul 2026· 2026 International Conference on Intelligent and Sustainable AI Systems (ICOSAAS)· pp. 135-142· 0 citations· 16 references
Abstract
The increasing complexity of modern network environments has heightened the need for practical and scalable intrusion detection solutions. This study presents the development of a real-time, flow-based Intrusion Detection and Security Management System (IDSMS) that integrates live traffic monitoring, machine learning-based intrusion analysis, centralized data storage, and web-based visualization. The system captures network traffic from a MikroTik-based gateway using a passive flow sniffer deployed on a Kali Linux monitoring node. Packets are aggregated into bidirectional flows and transformed into statistical feature vectors, which are analyzed by a machine learning inference service through an application programming interface. Detection results, including risk level and attack classification, are stored in a centralized database and presented through an interactive dashboard. The intrusion detection engine employs a two-stage ensemble approach: Stage A performs binary classification (benign vs. malicious) using a calibrated stacking ensemble of Random Forest, Gradient Boosting, and XGBoost classifiers with Logistic Regression as meta-classifier, achieving 99.92% accuracy and 0.99987 ROC-AUC. Stage B performs multi-class classification across 14 attack categories using a Random Forest classifier, achieving 99.83% accuracy with per-class F1-scores exceeding 99.6%. Development-stage testing using simulated attack traffic demonstrates the system’s ability to capture, analyze, and visualize network threats in real time, with average inference latency of 12.4 ms per flow and processing throughput of 3,842 flows per minute. The proposed system provides a practical foundation for deployment in shared-access networks, small enterprises, and IoT-enabled environments.
The increasing frequency and advance of Distributed Denial of Service (DDoS) attacks have rendered traditional signature-based detection methods insufficient for protecting modern network infrastructures. This study presents the development of an intelligent DDoS detection and mitigation system that synergizes router log analysis with flow-based traffic monitoring using ensemble machine learning. The proposed system continuously captures and processes router Syslog data and network flow records in real time, extracts statistical features from both data sources, and applies a Hist Gradient Boosting Classifier model for attack classification. The model achieved 99.96% accuracy and 99.97% F1-score on the holdout test set, with only 14 false positives and 24 false negatives out of 86,274 test samples. The system architecture integrates a web-based dashboard providing real-time visualization of network traffic, attack alerts, and mitigation actions. Automated mitigation mechanisms including rate limiting, IP blacklisting, and Access Control List (ACL) updates are triggered upon attack confirmation. Evaluation using the CICDDoS2019 dataset demonstrates the system's effectiveness with high detection accuracy and low false-positive rates. The proposed system provides a scalable, cost-effective, and privacy-preserving solution suitable for deployment in ISP and enterprise networks without reliance on commercial DDoS mitigation appliances.
Keano Nikko L. Sy, Patrick D. Cerna· 2026 International Conferenc...· 0 citations
: As the internet usage is exponentially increasing and with the emerging cyber threats, the conventional rule-based intrusion detection systems (IDS) are limited to identifying new and advanced attacks. The paper features an artificial intelligence-powered Intrusion Detection System (IDS) utilizing the machine learning methods to detect the malicious actions in the network traffic automatically. The system based on the CICIDS datasets, data preprocessing, feature selection, and a Random Forest classifier was used to determine various types of intrusions with a high success rate. The capability of the system to classify intrusions, generate confidence scores and be interpretable with feature importance analysis is evidenced by real-time packet-level simulation. Besides, the model is combined with a notification system that will notify through email or SMS in case of intrusions, so that timely response and mitigation is realized. The suggested framework does not only improve the detection performance, it also brings in scalability, automation, and transparency, which is appropriate in the present day network setup.
S. S, Martin Victor· Proceedings of the 1st Inter...· 0 citations
A thorough analysis of a modest version of a suggested system that use Support Vector Machines (SVM) to address networking anomaly and misuse detection in the face of insurmountable obstacles, foreseeing an all-encompassing solution to modern network security issues.
Gaurav Kishor Saxena, Shambhu Dayal Sahu· International Journal of Cre...· 0 citations
The exponential rise in cyber threats has created a critical need for intelligent and adaptive intrusion detection systems
(IDS) capable of identifying both known and emerging attack patterns. Traditional rule-based IDS mechanisms, such as Snort,
rely heavily on predefined signatures and struggle against sophisticated attacks including port scanning, web-based exploits, and
distributed denial-of-service (DDoS) attacks. This paper presents an AI-based Intrusion Detection System that integrates
network simulation, machine learning, and real-time visualization into a unified three-layer framework. The NS-3 network
simulator generates realistic normal and malicious traffic between attacker, router, and victim nodes; the resulting packetcapture (PCAP) data is processed by a Python-based IDS engine that applies signature rules for port scanning, DoS flooding,
and web attacks (SQL Injection, XSS, LFI, command injection); and a Random Forest classifier, trained on the CIC-IDS2017
benchmark dataset, augments detection with machine-learning-based classification. A Flask-based web dashboard provides realtime visualization of alerts, packet statistics, and attack distribution. Experimental results show an average detection accuracy of
98.5%, an average F1-score of 97.7%, and a false-positive rate below 1.2%, outperforming rule-based and prior deep-learning
baselines on comparable attack categories. The proposed multi-layered architecture demonstrates that combining simulation,
machine learning, and visualization can produce a scalable and effective solution for modern network security challenges.
T. Senthil, V. Shanmuganeethi· International Journal for Re...· 0 citations
Security researchers rely heavily on Network Intrusion Detection Systems (NIDS) to keep an eye on network traffic and notify administrators of any suspicious activities. The purpose of this paper is to offer a comprehensive overview of intrusion detection systems (IDS), including the following topics: fundamentals, kinds of IDS, methods for detecting intrusions in NIDS, the architecture of IDS, data pre-processing, and examples of ML techniques used in NIDS. This covers several detection methods, including signature-based, anomaly-based, specification-based, and behavior-based approaches, as well as their advantages and disadvantages in recognizing both existing and new cyber threats. The review also covers the architecture of NIDS which consists of network sensors, preprocessors, network traffic analysis, alert generation and security analysis. A variety of ML techniques, including supervised, unsupervised, semi-supervised, ensemble, and deep learning (DL) approaches, are being explored to improve the accuracy and adaptability of intrusion detection systems (IDS). Other applications such as DoS/DDoS attack detection, Malware detection, Botnets, Brute force attacks, Insider compromise, IoT compromise and Critical infrastructure threats are also shown. Despite all the challenges in terms of false positives, scalability, computational complexity, data quality, and novel attack styles, the features that ML can provide for intelligent, adaptive, and accurate intrusion detection systems are appealing.
Madhav Sharma· International Journal of Cyb...· 0 citations
The rapid growth of cyber landscapes and the development of a new cybersecurity model incorporating PET, deep learning, fuzzy systems, keystroke dynamic authentication, and encryption. It is used to prevent attacks by malware or unauthorized access to cloud systems. The proposed framework, which integrates an artificial intelligence (AI)-driven approach with identity and access management (IAM), enables the adaptive implementation of risk-based login authentication and real time anomaly detection. Unlike conventional security systems that depend on fixed rules and signatures, we provide more sophisticated solutions. A Floydel firewall is dynamically tailored through deep neural networks (DNNs) and automatically adjusts to fluctuating traffic patterns. It employs malware classification based on behavior, utilizes fuzzy logic to manage uncertainty during intrusions, and uses keystroke dynamics for user verification through typing patterns. The experiment demonstrates a 97.6% detection accuracy on benchmark data, while significantly reducing false positives and ensuring data confidentiality through encryption. The nature of cloud security can evolve based on the specific circumstances and threats we encounter. Looking ahead, we plan to delve into cryptography and distributed training to bolster decentralized infrastructures. This proposed framework aims to fortify data protection and ensure user privacy in essential areas like healthcare, financial services, and e-governance, thereby fostering increased trust.
Sai Kiranmai Dornala, S. p· International Journal of Int...· 0 citations
We use cookies to run the site and, with your consent, for analytics and to show ads.
See our Cookie Policy.
