AI-Based Intrusion Detection System (IDS) for Signature Recognition Using Machine Learning and Network Simulation

Abstract

The exponential rise in cyber threats has created a critical need for intelligent and adaptive intrusion detection systems (IDS) capable of identifying both known and emerging attack patterns. Traditional rule-based IDS mechanisms, such as Snort, rely heavily on predefined signatures and struggle against sophisticated attacks including port scanning, web-based exploits, and distributed denial-of-service (DDoS) attacks. This paper presents an AI-based Intrusion Detection System that integrates network simulation, machine learning, and real-time visualization into a unified three-layer framework. The NS-3 network simulator generates realistic normal and malicious traffic between attacker, router, and victim nodes; the resulting packetcapture (PCAP) data is processed by a Python-based IDS engine that applies signature rules for port scanning, DoS flooding, and web attacks (SQL Injection, XSS, LFI, command injection); and a Random Forest classifier, trained on the CIC-IDS2017 benchmark dataset, augments detection with machine-learning-based classification. A Flask-based web dashboard provides realtime visualization of alerts, packet statistics, and attack distribution. Experimental results show an average detection accuracy of 98.5%, an average F1-score of 97.7%, and a false-positive rate below 1.2%, outperforming rule-based and prior deep-learning baselines on comparable attack categories. The proposed multi-layered architecture demonstrates that combining simulation, machine learning, and visualization can produce a scalable and effective solution for modern network security challenges.