DyP-CNX: A Dynamic Preprocessing-Enhanced Hybrid Model for Network Intrusion Detection

The proliferation of connected devices and increasingly sophisticated cyberattacks necessitate an evolution beyond traditional, single-paradigm intrusion detection systems (IDS). Signature-based methods fail against zero-day threats, while pure anomaly-based systems often suffer from high false-positive rates. This study proposes and evaluates a novel Hybrid Intelligence-Based Model for Network Intrusion Detection that synergistically integrates signature, anomaly, and AI-driven machine learning components. The core innovation is a soft-voting ensemble mechanism combining three robust classifiers Random Forest (RF), Support Vector Classifier (SVC), and Extreme Gradient Boosting (XGBoost) to achieve a resilient and highly accurate detection framework. Using a rigorously preprocessed, class-balanced subset of the CIC-IDS2017 dataset, the ensemble model achieved 99.2% accuracy on the multi-class test set. A critical feature ablation study demonstrated that this near-perfect performance was maintained even after excluding the single most dominant feature (Destination Port), validating the model's robustness and reliance on diverse, generalized flow characteristics (e.g., TCP flag dynamics and inter-arrival times). The findings confirm the viability of AI-driven hybridization as a superior, adaptive defense strategy against both known and emerging network threats.

Recently, machine learning methodologies are playing an important role in detecting network intrusions (or attacks), which further helps the network administrator to take precautionary measures for preventing intrusions. In this project report, the authors propose to use various techniques like support vector machine, logistic regression, random forest, decision tree, and a hybrid model using artificial neural networks and random forest. The new hybrid model for network intrusion detection aims to achieve better precision, recall, accuracy, and F1 score. To reify this, combined artificial neural network and random forest algorithms are used. In the hybrid model, ANN works as a feature extractor and random forest as a classifier. The data is provided to ANN and the ANN generates new features on the basis of given input. The new features are then provided to random forest as an input. The random forest then classifies the data into different classes on the basis of new data. Here, KddCup99 dataset has been used to evaluate the models and accuracy achieved in each model.

Intrusion Detection Systems (IDS) play a vital role in monitoring and preventing unauthorized access within critical network infrastructures. However, current IDS approaches often suffer from limitations in detection accuracy, scalability, and adaptability to evolving threats. To address these challenges, this study proposes an optimized Long Short-Term Memory Recurrent Neural Network (LSTM-RNN) model for network-based intrusion detection. The model is specifically designed to capture temporal dependencies in sequential network traffic data, enabling accurate classification of benign and malicious activity while maintaining computational efficiency. The proposed model underwent rigorous validation to assess both its detection accuracy and generalizability. This was achieved by utilizing two distinct datasets that encompass realistic network traffic and a wide array of attack scenarios, including Denial of Service (DoS), Probe, User-to-Root (U2R), and Remote-to-Local (R2L) intrusions. The performance of the model is compared with several other recent models. The proposed model achieved high classification results among all the compared models, with an accuracy of 99.94%, precision of 99.98%, recall of 99.93%, and an F1-score of 99.95%. These outstanding results underscore the model’s robust capability to accurately identify and flag malicious activities within complex network environments. The model’s generalization power was similarly affirmed on a second independent dataset. The model maintained strong performance with an accuracy of 99.42%, precision of 99.20%, recall of 99.69%, and an F1-score of 99.45%. The successful demonstration of both high detection accuracy and strong generalization capability highlights the practical utility and inherent reliability of our proposed model for real-world threat detection.

With the rapid development of information technology, network security issues have become increasingly prominent. In particular, data security intrusions pose serious threats to the data privacy and system security of enterprises and individuals. Traditional intrusion detection systems often exhibit low detection accuracy and high false alarm rates when faced with complex and dynamic network environments and diverse attack methods. Therefore, this paper proposes a data security intrusion detection system based on deep learning, which integrates the Mamba model and ECANet model and employs an end-to-end learning approach for training and optimization. First, the Mamba model is introduced for preliminary data feature extraction, whose efficient feature representation capabilities provide a solid foundation for the subsequent detection process. Then, by integrating the ECANet model, feature selection is further optimized through the attention mechanism, enhancing the model’s focus on important features. Finally, an end-to-end learning approach is adopted to train and optimize the entire system, ensuring excellent performance and robustness in practical applications. Experimental results show that the proposed intrusion detection system demonstrates higher detection accuracy on multiple test datasets, improving by approximately 5% compared to traditional methods, providing a new and effective solution for data security.

Cyber-physical systems (CPSs) unite the computation with physical methods. Embedded networks and computers observe and handle the physical procedures, generally with feedback encircles whereas physical procedures affect computation and conversely. In the last decade, the prompt growth of network-associated services has formed confidential information on the Internet. However, networks are much inclined to intrusions wherever unapproved consumers try to retrieve confidential data and even disturb the systems. Constructing a proficient network intrusion detection system (IDS) can be essential to avert these attacks. Utilizing digital twin technology enhances the IDS of physical devices in CPSs. IDSs normally utilize machine learning (ML) techniques for categorizing the attacks. However, the features employed for classifications are not appropriate or adequate all the time. Moreover, the amount of intrusions can be significantly lower than the amount of non-intrusions. Therefore, simple techniques may fail to deliver satisfactory performances owing to this class imbalance. In this study, we offer a Metaheuristic-Driven Hybrid Deep Learning Model for Robust Intrusion Detection in Secure Cyber-Physical Systems (MHDLM-RIDCPS) model in Smart City Environment. The proposed MHDLM-RIDCPS technique primarily targets the classification and recognition of intrusions using digital twin technology to enhance security within the CPS. Primarily, the proposed MHDLM-RIDCPS approach utilizes min-max normalization for transforming an input data into a standardized format. To alleviate dimensionality issues, the coyote optimization algorithm (COA) can be executed to select a subset of features. In addition, the modified prairie dog optimizer (mPDO) combined with a convolutional neural network and bi-directional long short-term memory with attention mechanism (AM-CNN+BiLSTM) classifier is exploited for the identification of intrusions. The design of the mPDO system primarily concentrates on the parameter optimizer of the AM-CNN+BiLSTM algorithm and so improves the classifier performances. To determine the greater efficiency of the MHDLM-RIDCPS system, a comprehensive set of simulations can be applied and the performances are tested over distinct aspects. The experimental analysis guaranteed the superior results of the MHDLM-RIDCPS methodology with existing methods

The rapid growth of the Internet of Things (IoT) expands the attack surface and increases the need for effective intrusion detection under strict privacy and resource constraints. Conventional intrusion detection systems (IDSs) commonly rely on centralized data collection, which can expose sensitive traffic data, increase communication overhead, and create single points of failure. This paper presents a federated learning-based IDS (FL-IDS) that trains a convolutional neural network (CNN) collaboratively across distributed IoT clients without sharing raw traffic data. Each client performs local training on its private data, and a central server aggregates model updates using Federated Averaging (FedAvg) to form a global model. We evaluate the proposed FL-IDS on the Bot-IoT dataset after preprocessing and balancing class via under sampling. Experimental results show that the global model achieves 98.12% accuracy with strong precision, recall, and F1-score, and the learning curves indicate stable convergence across clients. The study demonstrates the feasibility of combining federated learning with deep models for privacy-preserving intrusion detection in distributed IoT settings, while also highlighting key limitations and directions for future work such as evaluation under non-IID client distributions and computational cost analysis.

Network intrusion detection plays an important role in the network security, but the increasingly complex network environment brings a serious challenge to intrusion detection. Although the existing efficient Convolutional Neural Network (CNN)-based network traffic intrusion detection models do not require manual design of the traffic features, but they do not make full use of the structured information of network traffic. In this paper, we propose a novel network intrusion detection model based on Temporal Convolutional Networks (TCN), it extracts the key features in the dataset through exploiting the characteristics of byte sequence in the network traffic packets. Compared with traditional recurrent neural networks (RNN), TCN shows a better performance in sequence modeling tasks and it can process the sequences in parallel for faster training. To solve the problem of poor detection accuracy caused by the "death" of some neurons on ReLU during the training stage, we use the ELU activation function in the TCN instead of ReLU. Finally, we compare our proposed TCN-based intrusion detection model with the state-of-the-art methods on the CTU public dataset, and the experimental results show that the use of TCN can obtain higher performance within less time consumption, in terms of higher average accuracy, higher average recall and higher average F1-measure.

Today, intrusion detection system using the neural network is an interested and considerable area for the research community. The computational intelligence systems are defined on the basis of the following parameters: fault tolerance and adaptation; adaptable the requirements of make a better intrusion detection model. In this paper, provide an overview of the research progress using computational intelligence to the problem of intrusion detection. The goal of this paper summarized and compared research contributions of Intrusion detection system using computational intelligence and neural network, define existing research challenges and anticipated solution of machine learning. Research showed that application of machine learning techniques in intrusion detection could achieve high detection rate. Machine learning and classification algorithms help to design "Intrusion Detection Models" which can classify the network traffic into intrusive or normal traffic. This paper discusses some commonly used machine learning techniques in Intrusion Detection System and also reviews some of the existing machine learning IDS proposed by researchers at different times.

The increasing counterfeit of the internet usage has raised concerns of the security agencies to work very hard in order to diminish the presence of the abnormal users from the web. The motive of these illicit users (called intruders) is to harm the system or the network either by gaining access to the system or prohibiting genuine users to access the resources. Hence in order to tackle the abnormalities Intrusion Detection System (IDS) with Data Mining has evolved as the most demanding approach. On the one end IDS aims to detect the intrusions by monitoring a given environment while on the other end Data Mining allows mining of these intrusions hidden among genuine users. In this regard, IDS with Data Mining has been through several revisions in consideration to meet the current requirements with efficient detection of intrusions. Also several models have been proposed for enhancing the system performance. In context to improved performance, the paper presents a new model for intrusion detection. This improved model, named as REP (Reduced Error Pruning) based Intrusion Detection Model results in higher accuracy along with the increased number of correctly classified instances.

Traditional firewalls and data encryption techniques can no longer match the demands of current IoT network security due to the rising amount and variety of network threats. In order to manage IoT network risks, intrusion detection solutions have been advised. Even though machine learning (ML) helps the widely used intrusion detection techniques currently in use, these algorithms struggle with low detection rates and the requirement for extensive feature engineering. The deep learning model for IoT network intrusion detection is a method for traffic anomaly detection that is suggested by this study. To extract the sequence properties of data flow through a CNN, it combines an attention mechanism with a Long Short Term Memory (LSTM) network. This method uses adaptive synthetic sampling (ADASYN) to increase the size of minority-class samples. The proposed models demonstrated acceptable precision and recall for each class when used for binary-class classification, proving their stability and capacity to identify all classes correctly. The MLP classifier’s accuracy, precision, recall, and F1 value were 87%, 89%, 87%, and 89%, respectively, with an AUC score of 0.88. Overall, the proposed models performed well. The attack and all-class models exhibited good AUCs and macro metrics, the same as the proposed MLP classifier, which had an F1 score of 83% and an AUC score of 0.94. Additionally, it trained the MLP classifier and integrated the ADAM optimizer and category cross-entropy loss function for all-class classification. With an AUC value of 94%, it possessed 84% accuracy, 87% precision, 84% recall, and an 83% F1 score. A further indication of the hybrid model’s ability to combine the benefits of both models to improve overall performance was that it regularly outperformed the MLP model. This model’s accuracy and F1 score are better than those of earlier comparable algorithms, according to experimental results using the publicly accessible benchmark dataset for network intrusion detection (NSL–KDD).

Destructive cyber-attacks and cybercriminals are increasing with the increase in IoT (Internet of Things) devices globally. This ha/s led to the need for increase in security in IoT systems. Innovative and novel techniques are used by the intruders to accomplish malicious goals effectively through cyber-attacks. An Intrusion Detection System (IDS) is used for classification of attacks in IoT networks based on anomaly detection and machine learning techniques. Inefficiency is observed in the conventional machine learning models and intrusion detection techniques as the network technologies are unpredictable. Accurate identification of various anomalies is possible with deep learning models in several research segments. The input data along with its prominent characteristics may be categorized automatically for classification and anomaly detection using convolutional neural networks (CNN). Faster computations are enabled due to the performance efficiency of CNN. For IoT networks, an intrusion detection model based on anomaly detection is designed and developed in this paper. A multiclass classification framework is created initially using a CNN model. Further, 3D CNN is used for implementation of the proposed model. Various intrusion detection datasets from IoT networks are used for validation of the proposed CNN model. Pre-trained multiclass CNN model is used for implementation of multiclass and binary classification based on transfer learning. When compared to the conventional deep learning models, the proposed multiclass and binary classification framework has attained improved F1 score, recall, precision and accuracy.

Chapter 5 - Intrusion Prevention and Detection Systems

The growing development of IoT (Internet of Things) devices creates a large attack surface for cybercriminals to conduct potentially more destructive cyberattacks; as a result, the security industry has seen an exponential increase in cyber-attacks. Many of these attacks have effectively accomplished their malicious goals because intruders conduct cyber-attacks using novel and innovative techniques. An anomaly-based IDS (Intrusion Detection System) uses machine learning techniques to detect and classify attacks in IoT networks. In the presence of unpredictable network technologies and various intrusion methods, traditional machine learning techniques appear inefficient. In many research areas, deep learning methods have shown their ability to identify anomalies accurately. Convolutional neural networks are an excellent alternative for anomaly detection and classification due to their ability to automatically categorize main characteristics in input data and their effectiveness in performing faster computations. In this paper, we design and develop a novel anomaly-based intrusion detection model for IoT networks. First, a convolutional neural network model is used to create a multiclass classification model. The proposed model is then implemented using convolutional neural networks in 1D, 2D, and 3D. The proposed convolutional neural network model is validated using the BoT-IoT, IoT Network Intrusion, MQTT-IoT-IDS2020, and IoT-23 intrusion detection datasets. Transfer learning is used to implement binary and multiclass classification using a convolutional neural network multiclass pre-trained model. Our proposed binary and multiclass classification models have achieved high accuracy, precision, recall, and F1 score compared to existing deep learning implementations.

Intrusion detection (ID) is an important component of infrastructure protection mechanisms. Intrusion detection systems (IDSs) need to be accurate, adaptive, and extensible. Given these requirements and the complexities of today's network environments, we need a more systematic and automated IDS development process rather that the pure knowledge encoding and engineering approaches. This article describes a novel framework, MADAM ID, for Mining Audit Data for Automated Models for Instrusion Detection. This framework uses data mining algorithms to compute activity patterns from system audit data and extracts predictive features from the patterns. It then applies machine learning algorithms to the audit records taht are processed according to the feature definitions to generate intrusion detection rules. Results from the 1998 DARPA Intrusion Detection Evaluation showed that our ID model was one of the best performing of all the participating systems. We also briefly discuss our experience in converting the detection models produced by off-line data mining programs to real-time modules of existing IDSs.

With the rapid development of Internet, the issue of cyber security has increasingly gained more attention. An intrusion Detection System (IDS) is an effective technique to defend cyber-attacks and reduce security losses. However, the challenge of IDS lies in the diversity of cyber-attackers and the frequently-changing data requiring a flexible and efficient solution. To address this problem, machine learning approaches are being applied in the IDS field. In this paper, we propose an efficient scalable neural-network-based hybrid IDS framework with the combination of Host-level IDS (HIDS) and Network-level IDS (NIDS). We applied the autoencoders (AE) to NIDS and designed HIDS using word embedding and convolutional neural network. To evaluate the IDS, many experiments are performed on the public datasets NSL-KDD and ADFA. It can detect many attacks and reduce the security risk with high efficiency and excellent scalability.