Optimized Fast-Learning Network Model With SMOTE for University Network Intrusion Detection Systems

Abstract

Traditional Intrusion Detection Systems (IDSs) tend to have a high false positive detection rate, are time-consuming to train, and lack the flexibility to react quickly to changing cyber threats, such as Distributed Denial of Service (DDoS) attacks and phishing. Such restrictions decrease the responsiveness and reliability of the IDS services implemented in the university network, both wired and wireless, at the Uganda Christian University (UCU), where network and traffic analysis have become a necessity. This study analyzes the current threat environment of networking at UCU in terms of the type, origin, and target of various attacks to identify gaps in existing detection tools. To address data imbalance and high dimensionality, a range of machine learning algorithms was implemented and paired: Random Forest (RF), XGBoost, AdaBoost, Decision Trees, Convolutional Neural Networks (CNNs), and SMOTE. The highest performance was obtained by the combination of RF and SMOTE, with an accuracy of 81.88%, a precision of 82.17%, a recall of 81.88% and an F1-score of 80.19%. These ensemble learning methods can be effectively combined with oversampling to better detect minority attacks and minimize false alarms. This paper proposes an OFLN by addition of PSO to perform automated hyperparameter optimization and MAML to enable high-speed adaptation to new and previously seen attacks. The OFLN incorporates swarm-based optimization with meta-learning, attaining faster convergence, better generalization and efficiency. Empirical results show that OFLN is more effective than baseline ensemble models in detection accuracy, resistance to class imbalance and training efficiency, making it an innovative, scalable and practical IDS.