Comparative Analysis Network-Based Intrusion Detection Framework using Machine-Learning with Python and MERN Stack

Abstract

Due to the growing amount of data, evolving attack tactics, and the limitations of conventional signature-based methods in real-time scenarios, network intrusion detection is getting harder. In order to decrease false positives and improve detection accuracy, this paper proposes a hybrid real-time network intrusion detection system that blends supervised machine learning ensembles with a confidence-aware hybrid decision engine. Using Python-based packet capture modules, live network traffic is captured using lightweight flow-level feature extraction consistent with the CICIDS2018 dataset. The predictions of several supervised classifiers that are trained and operated simultaneously are combined using ensemble voting and model dominance analysis. The hybrid decision engine further enhances the alarms by considering voting agreement, protocol knowledge, flow context, and confidence levels, allowing for cautious alerting in low-attack-prevalence scenarios. Experimental results on real-time traffic capture and benchmark datasets show an enhanced F1-score of 82.72%, a very low false positive rate, flawless recall for attack events, and an excellent detection accuracy of 99.81%. Because the solution enables real-time logging and visualization via a web-based dashboard, it is both scalable and useful for real-time network security monitoring applications.