Jul 2026· International Journal of Creative and Open Research in Engineering and Management· Vol 02, pp. 1-11· 0 citations
TL;DR
A machine learning–based intrusion detection system capable of automatically analyzing network traffic and distinguishing malicious activity from legitimate behavior is presented, demonstrating that machine learning offers a scalable, adaptive, and largely automated foundation for securing contemporary network infrastructures.
Abstract
Modern computer networks face a persistent and growing range of cyber threats, including unauthorized access, malware infiltration, denial-of-service attacks, and data exfiltration. Conventional signature- and rule-based intrusion detection systems (IDS) struggle to identify zero-day attacks and evolving intrusion patterns as networks expand in scale and complexity, and they typically require frequent manual updates to remain effective. This paper presents a machine learning–based intrusion detection system capable of automatically analyzing network traffic and distinguishing malicious activity from legitimate behavior. By learning from historical traffic data, the proposed system adapts to emerging threats with greater accuracy than static, rule-driven approaches. The system is implemented in Python using established data-analytics and machine-learning libraries, and it evaluates several supervised classifiers—Random Forest, Support Vector Machine, Naïve Bayes, and Logistic Regression—to categorize network traffic as normal or intrusive. Experimental results show that the Random Forest classifier consistently achieves the strongest overall performance, and the integration of real-time packet capture with a visualization dashboard enables continuous, interpretable monitoring. The findings demonstrate that machine learning offers a scalable, adaptive, and largely automated foundation for securing contemporary network infrastructures.
The exponential rise in cyber threats has created a critical need for intelligent and adaptive intrusion detection systems
(IDS) capable of identifying both known and emerging attack patterns. Traditional rule-based IDS mechanisms, such as Snort,
rely heavily on predefined signatures and struggle against sophisticated attacks including port scanning, web-based exploits, and
distributed denial-of-service (DDoS) attacks. This paper presents an AI-based Intrusion Detection System that integrates
network simulation, machine learning, and real-time visualization into a unified three-layer framework. The NS-3 network
simulator generates realistic normal and malicious traffic between attacker, router, and victim nodes; the resulting packetcapture (PCAP) data is processed by a Python-based IDS engine that applies signature rules for port scanning, DoS flooding,
and web attacks (SQL Injection, XSS, LFI, command injection); and a Random Forest classifier, trained on the CIC-IDS2017
benchmark dataset, augments detection with machine-learning-based classification. A Flask-based web dashboard provides realtime visualization of alerts, packet statistics, and attack distribution. Experimental results show an average detection accuracy of
98.5%, an average F1-score of 97.7%, and a false-positive rate below 1.2%, outperforming rule-based and prior deep-learning
baselines on comparable attack categories. The proposed multi-layered architecture demonstrates that combining simulation,
machine learning, and visualization can produce a scalable and effective solution for modern network security challenges.
T. Senthil, V. Shanmuganeethi· International Journal for Re...· 0 citations
This review presents a comprehensive analysis of machine learning-based intrusion detection systems, covering a wide range of techniques including supervised learning, unsupervised learning, ensemble learning, and deep learning models, and discusses critical challenges affecting the deployment of ML-based IDS.
Ranobir Hasan, H. Jamal, Kamal Kamal et al.· The Eastasouth Journal of In...· 0 citations
A thorough analysis of a modest version of a suggested system that use Support Vector Machines (SVM) to address networking anomaly and misuse detection in the face of insurmountable obstacles, foreseeing an all-encompassing solution to modern network security issues.
Gaurav Kishor Saxena, Shambhu Dayal Sahu· International Journal of Cre...· 0 citations
Security researchers rely heavily on Network Intrusion Detection Systems (NIDS) to keep an eye on network traffic and notify administrators of any suspicious activities. The purpose of this paper is to offer a comprehensive overview of intrusion detection systems (IDS), including the following topics: fundamentals, kinds of IDS, methods for detecting intrusions in NIDS, the architecture of IDS, data pre-processing, and examples of ML techniques used in NIDS. This covers several detection methods, including signature-based, anomaly-based, specification-based, and behavior-based approaches, as well as their advantages and disadvantages in recognizing both existing and new cyber threats. The review also covers the architecture of NIDS which consists of network sensors, preprocessors, network traffic analysis, alert generation and security analysis. A variety of ML techniques, including supervised, unsupervised, semi-supervised, ensemble, and deep learning (DL) approaches, are being explored to improve the accuracy and adaptability of intrusion detection systems (IDS). Other applications such as DoS/DDoS attack detection, Malware detection, Botnets, Brute force attacks, Insider compromise, IoT compromise and Critical infrastructure threats are also shown. Despite all the challenges in terms of false positives, scalability, computational complexity, data quality, and novel attack styles, the features that ML can provide for intelligent, adaptive, and accurate intrusion detection systems are appealing.
Madhav Sharma· International Journal of Cyb...· 0 citations
The findings indicate that the RF–SVM hybrid model provides an effective and scalable solution for real-time intrusion detection in modern cybersecurity environments.
Esther J., Grace Phiri, Arockia Venice J.· International Journal of Dat...· 0 citations
Network infrastructure faces mounting pressure from increasingly sophisticated cyber attacks targeting systems reliant on digital connectivity. Activities such as Denial of Service, Probe, Remote-to-Local, and User-to-Root represent persistent threats that are challenging to intercept manually owing to high traffic volumes and rapidly evolving intrusion strategies. This work constructs a web-based Intrusion Detection System prototype by training an entropy-based Decision Tree classifier, conceptually grounded in the C4.5 framework, on the NSL-KDD benchmark. Development adheres to the six-phase CRISP-DM process encompassing business understanding, data preparation, model construction, performance evaluation, and system deployment. Preprocessing involves duplicate record elimination, categorical attribute encoding, and consolidation of multi-class attack labels into a binary Normal/Anomaly scheme. Ten-fold cross-validation yields 99.34% accuracy and 99.35% precision for the Decision Tree, representing a substantial margin over Naive Bayes which attains only 66.67% accuracy. A separate Gain Ratio analysis designates src_bytes as the most informative feature with a value of 0.5366, positioning it as the decision tree root node. The prototype is served through a Streamlit web application that accepts CSV dataset uploads, executes batch anomaly classification, presents detection outcomes through interactive visualizations, and produces exportable reports in both CSV and PDF formats. The system offers an interpretable and practically accessible batch-detection tool, continuous real-time monitoring and evaluation on contemporary intrusion benchmarks are identified as priorities for subsequent research.
Daniel Erick Witopo, Hartana Wijaya· bit-Tech· 0 citations
We use cookies to run the site and, with your consent, for analytics and to show ads.
See our Cookie Policy.
