Automated Intrusion Detection and Prevention System using Machine Learning

Abstract

Cyberspace is becoming a growing arena of threats and intrusion detection systems have become an important challenge in the network. Conventional signature-based solutions are no longer sufficient to cope with this increasing complexity. This paper introduces an Automated Intrusion Detection and Prevention System (AIDPS) based on NSL-KDD dataset. It uses a combination of supervised and unsupervised machine learning to identify and categorize network-based attacks in real-time. Seven types of attacks, including DDoS, Brute Force, Port Scanning, Botnet Activities, Privilege Escalation, Service Exploits, and SQL Injection, were classified and tested using six classification algorithms: Random Forest, Extra Trees, Decision Tree, AdaBoost, K-Nearest Neighbors, and XGBoost. Random Forest showed the best performance with the accuracy of 98.12% and F1 score of 0.9813 in the test set of 29704 samples. Additionally, an ensemble Voting Classifier, consisting of the top three algorithms was designed and tested. In addition to the model training, a live prediction module was created that determines the classification of new network traffic records in real time and provides an attack type and confidence score for each record, as well as an overall network threat assessment. An automated IP blocking service which enforces firewall rules to iptables on Linux and netsh on Windows. A custom Flask web dashboard provides security analysts with real-time alert streaming, batch CSV analysis across three operational modes automatic, manual, and hybrid blocked IP management, PDF and CSV report generation, and role-based user authentication. The system addresses key limitations in existing work. The system solves problems with current methods. Mainly, that they only work when tested offline and can't be used in real time, because they integrate a complete pipeline from raw-traffic feature extraction to automated threat-level classification. Results show that the hybrid supervised-unsupervised approach consistently outperforms single-model baselines, especially in detecting minority attack categories such as Privilege Escalation (F1: 0.8980) and Brute Force (F1: 0.9814)