Hybrid ML-DL Based Network Intrusion Detection System in Data Science Framework

Vel Tech Rangarajan Dr.Sagunthala R&D Institute of Science and Technology, Computer Science Department, Avadi, Chennai

^* e-mail: This email address is being protected from spambots. You need JavaScript enabled to view it.
^** e-mail: This email address is being protected from spambots. You need JavaScript enabled to view it.
^*** e-mail: This email address is being protected from spambots. You need JavaScript enabled to view it.

Abstract

Network intrusion detection systems (NIDS) are important in securing the current network infrastructures against the emerging cyber attackers. This paper introduces NIDS, which is one of the hybrid frameworks of machine learning and deep learning ensemble models to classify network traffic as normal or malicious traffic. The proposed system is composed of six classification models, namely Convolutional Neural Networks (CNN), Long Short-Term Memory (LSTM), K-Nearest Neighbors (KNN), Support Vector machines (SVM), Random Forest, and Naive Bayes. Both models examine the features of the network separately and generate an intrusion probability that is combined to come up with the final prediction in a weighted ensemble strategy. The system offers the two popular benchmark datasets, such as NSL-KDD and CI-CIDS2017, having different feature representation and traffic properties. Each dataset has its own separate preprocessing pipelines and trained model sets that allow one to select the dataset dynamically using a web-based interface. Experimental analysis has shown that the ensemble method has an accuracy of 76.59 on NSL-KDD and 98.61 on CICIDS2017 and it is also able to give consistent results and performance in terms of precision, recall, and F1-score. The suggested framework is deployed as a full-stack software package that entails Python analytics engine, Node.js backend, MongoDB database and frontend made in React. The findings also demonstrate the efficiency of hybrid ensemble learning in refining the operation of intrusion detection in the heterogeneous network setup.