Machine Learning Intrusion Detection System: Building a Smarter Network Defence
Notice: This is a sample project for study and reference. Submitting it as your own work violates most universities' academic integrity policies.
Abstract
About This Research Topic
Every network defence team eventually runs into the same uncomfortable truth: attackers do not always repeat themselves. A machine learning intrusion detection system is built to deal with exactly that problem. Rather than waiting for a security analyst to write a new rule for every fresh attack pattern, it learns the underlying shape of normal and malicious traffic directly from data, so that it can flag suspicious behaviour even when the exact attack has never been logged before.
This article walks through a complete undergraduate research project that puts that idea to the test. It compares classical machine learning, ensemble methods, and a stacked ensemble model across two well-known network security datasets, tests three feature-selection strategies, and wraps the strongest model in a working alert dashboard. If you are exploring similar territory for your own final-year research, our Computer Science project topics library has further reference projects that show how this kind of methodology chapter, results chapter, and system implementation typically come together.
Main Abstract
Signature-based intrusion detection systems remain useful, but they share one structural weakness: they can only catch what they already recognise. Once an attacker varies their technique even slightly, a purely signature-driven system has no way of raising an alarm, because no matching entry exists in its database. This weakness is what has pushed so much recent research toward machine-learning-based detection, which builds a model of what normal and malicious traffic look like from historical data rather than from a fixed rulebook.
This study designs, builds, and tests a machine-learning-based network intrusion detection pipeline, following the Design Science Research approach alongside the CRISP-DM process for the data-driven stages of the work. Two public benchmark datasets anchor the evaluation: NSL-KDD, a cleaned-up successor to the long-standing KDD Cup 1999 dataset, and CICIDS2017, a newer and more realistic dataset built by the Canadian Institute for Cybersecurity that captures a wider spread of modern attack behaviour, including brute-force attempts, denial-of-service traffic, web-based attacks, infiltration, and botnet activity.
After cleaning and encoding the data, three feature-selection techniques were tested side by side — Recursive Feature Elimination, Mutual Information, and Lasso-based selection — ahead of training four models: Naive Bayes, Random Forest, XGBoost, and a stacked ensemble that blends Random Forest, XGBoost, and Extra-Trees under a Logistic Regression meta-model. Both a binary classification task (normal versus attack) and a multi-class task (identifying the specific attack type) were evaluated.
The stacked ensemble, paired with Recursive Feature Elimination, came out on top across both datasets, reaching 99.6% accuracy and a 99.4% F1-score on CICIDS2017, and 99.1% accuracy with a 98.7% F1-score on NSL-KDD. It consistently outperformed the standalone Random Forest, XGBoost, and Naive Bayes models. The multi-class results told a more nuanced story: overall performance stayed strong, but recall dropped noticeably for rare attack categories such as infiltration and certain web-attack subtypes, a pattern directly tied to how few training examples those classes have relative to normal traffic.
To close the loop between research and practice, the trained binary model was deployed behind a Flask-based monitoring dashboard that reads a simulated live traffic feed, scores each flow for intrusion risk, and raises a security alert when something looks malicious — with an average classification latency of just 8 milliseconds per flow. Taken together, the findings support stacked ensembles combined with careful feature selection as a strong, computationally realistic foundation for machine-learning-based intrusion detection, while cautioning that the near-perfect accuracy figures often reported in this field need to be read alongside dataset-specific class imbalance and cross-dataset generalisation, not treated as a promise of identical real-world performance.
Chapter One Preview
Background to the Study
As organisations push more of their operations onto interconnected digital infrastructure, the scale and financial cost of cyber-attacks keep climbing year after year. Intrusion Detection Systems sit at the centre of the defensive response to this trend, watching network traffic continuously and flagging activity that looks malicious. The long-standing approach, signature-based detection, works by comparing incoming traffic against a maintained catalogue of known attack patterns, an approach documented in detail in the National Institute of Standards and Technology's guide to intrusion detection and prevention systems. Effective as it is against previously catalogued threats, this approach is structurally blind to zero-day attacks, since no signature yet exists to match against them.
Machine-learning-based detection was developed to close that gap. Instead of matching against a fixed list, it learns the statistical shape of normal versus malicious traffic from historical examples, which lets it generalise to attack variants it has never explicitly seen. A large body of academic work has applied everything from classical algorithms to deep learning architectures to this problem, frequently reporting very high accuracy figures. Much of that literature, however, leans on a single, often ageing, benchmark dataset, which raises a fair question: how much of that reported accuracy survives contact with a newer, more realistic traffic dataset? This study was designed specifically to test that question, by running the identical modelling pipeline across both an older benchmark (NSL-KDD) and a modern one (CICIDS2017).
Statement of the Problem
Signature-based intrusion detection cannot reliably catch novel or evolving attacks that fall outside its existing signature catalogue, which leaves networks exposed to zero-day threats and fast-mutating attack variants. Machine learning has been proposed as the fix, but a great deal of published research reports strong accuracy on a single dataset without checking whether that performance holds up on a second, differently structured dataset. Much of this literature also reports only an aggregate accuracy figure, which can quietly hide much weaker performance on the rare attack classes that matter most from a security standpoint, since malicious traffic — and rare attack types especially — make up a small slice of total network volume in most benchmark datasets.
This study responds to both gaps directly: it evaluates its modelling pipeline on two datasets of different vintage under one identical protocol, so that performance and generalisation can be compared directly, and it reports per-class results for the multi-class task rather than a single aggregate number, with specific attention paid to rare attack categories.
Aim and Objectives
The aim of this study is to design, build, and evaluate a machine-learning-based network intrusion detection system, benchmarked across classical, ensemble, and stacked ensemble modelling approaches and across two datasets of differing vintage, and to deploy the strongest model through a real-time traffic monitoring dashboard.
● Review existing literature and systems relevant to machine-learning-based network intrusion detection.
● Preprocess and engineer features from network flow data, and compare three feature-selection techniques — Recursive Feature Elimination, Mutual Information, and Lasso-based selection.
● Train and compare Naive Bayes, Random Forest, XGBoost, and a stacked ensemble model for both binary and multi-class classification.
● Evaluate model performance and generalisation across NSL-KDD and CICIDS2017.
● Conduct per-class performance analysis for the multi-class task, with particular attention to rare attack types.
● Implement and evaluate a web-based monitoring dashboard that ingests a simulated real-time traffic feed and raises security alerts based on the trained model.
● Evaluate the overall system through classification metrics, feature-selection comparison, latency testing, and a usability assessment.
Research Questions
● What machine learning techniques and benchmark datasets have been applied to network intrusion detection in existing literature, and what are their reported strengths and limitations?
● Which feature-selection technique — Recursive Feature Elimination, Mutual Information, or Lasso-based selection — yields the strongest downstream classification performance?
● How do Naive Bayes, Random Forest, XGBoost, and a stacked ensemble model compare for binary and multi-class network intrusion classification?
● To what extent does model performance generalise across benchmark datasets of differing vintage, and how does per-class performance vary for rare attack types?
● What is the latency and practical usefulness of a real-time network traffic monitoring dashboard built around the trained model?
Significance of the Study
This research speaks to several audiences at once. Network security teams get a benchmarked, practically grounded example of how machine-learning-based detection could sit alongside their existing signature-based defences, particularly for catching attack variants that fall outside any known signature. The academic community gains a same-protocol, cross-dataset comparison of classical, ensemble, and stacked ensemble approaches, together with a per-class analysis of rare attack types that pushes back against the field's habit of leaning too heavily on aggregate accuracy. Feature-selection researchers get a direct, controlled comparison of three techniques under one modelling protocol, and systems designers get a concrete illustration of what it actually takes to move an offline-trained intrusion detection model into a latency-tested, alert-generating tool. If you're shaping a similar project and want a second pair of eyes on your structure or methodology, ScholarNest's research coaching service pairs students with experienced researchers for exactly that kind of feedback.
Scope of the Study
This study is limited to network-flow-based intrusion detection using two publicly available benchmark datasets, NSL-KDD and CICIDS2017. It does not extend to packet-payload-level deep packet inspection, encrypted traffic analysis, or host-based intrusion detection. The work covers the full pipeline, from data preprocessing and feature selection through model training, benchmarking, and per-class performance analysis, to the implementation of a simulated real-time monitoring dashboard and system-level latency testing. It stops short of live deployment on a production network, integration with a security information and event management platform, or adversarial robustness testing against attackers deliberately trying to evade the trained model — all of which are flagged as natural next steps for further work.
Operational Definition of Terms
Intrusion Detection System (IDS): A system that monitors network or system activity for malicious actions or policy violations and produces reports or alerts when such activity is detected.
Network Flow: An aggregated summary of packets sharing common attributes — source and destination IP, port, and protocol — over a defined time window, used as the unit of classification in flow-based intrusion detection.
Signature-Based Detection: An intrusion detection approach that identifies attacks by matching observed traffic against a database of known attack signatures or patterns.
Anomaly-Based / Machine-Learning-Based Detection: An intrusion detection approach that identifies attacks by learning to distinguish normal from malicious traffic patterns from data, rather than relying solely on a fixed signature database.
Feature Selection: The process of identifying and retaining the subset of input features most relevant to a predictive task, used here to improve both classification performance and computational efficiency.
Stacked Ensemble: A machine learning technique that combines the predictions of multiple base models using a meta-model trained to optimally weight or combine their outputs.
Zero-Day Attack: A previously unknown or uncatalogued attack variant for which no signature yet exists in a signature-based detection system.
CICIDS2017: A modern network intrusion benchmark dataset produced by the Canadian Institute for Cybersecurity, built to reflect realistic background traffic alongside a broad range of contemporary attack types.
Conclusion
The clearest takeaway from this study is that a stacked ensemble, paired with careful feature selection, gives a genuinely strong and computationally realistic foundation for machine-learning-based intrusion detection — but the equally important takeaway is the caution attached to it. Near-perfect accuracy on one benchmark dataset is not the same as guaranteed performance in a live network, and the drop in recall on rare attack classes is a reminder that aggregate accuracy alone can hide the weaknesses that matter most operationally. For students building a related final-year project, this kind of cross-dataset, per-class evaluation approach is a useful model to borrow from. You can browse further worked examples in our project topics library for inspiration on structuring your own methodology and results chapters.
Frequently Asked Questions
1. What is a machine learning intrusion detection system?
It is a network security tool that learns to tell normal traffic apart from malicious traffic using patterns extracted from data, rather than relying only on a fixed database of known attack signatures.
2. Why is machine learning better than signature-based detection for some attacks?
Signature-based systems can only flag attacks that already match an entry in their database. Machine learning models generalise from patterns in the training data, giving them a better chance of catching variants of known attacks, including some zero-day traffic, that a signature database has never seen.
3. What are NSL-KDD and CICIDS2017?
NSL-KDD is a cleaned-up version of the older KDD Cup 1999 dataset, addressing redundancy issues in the original. CICIDS2017 is a newer, more realistic dataset from the Canadian Institute for Cybersecurity that reflects a broader range of contemporary attack types within realistic background traffic.
4. Which model performed best in this study?
A stacked ensemble combining Random Forest, XGBoost, and Extra-Trees under a Logistic Regression meta-model, paired with Recursive Feature Elimination, gave the strongest results on both datasets.
5. What does class imbalance mean in intrusion detection?
It refers to the fact that malicious traffic, and rare attack types especially, make up a small share of total traffic volume in most datasets, which makes it harder for a model to learn to recognise those rare classes reliably.
6. Why does the study test three feature-selection techniques?
Different feature-selection methods can surface different subsets of relevant traffic characteristics, so comparing Recursive Feature Elimination, Mutual Information, and Lasso-based selection under one protocol shows which approach gives the strongest downstream classification performance.
7. How fast was the deployed detection dashboard?
The Flask-based monitoring dashboard classified each simulated network flow in an average of 8 milliseconds, which supports the practicality of near-real-time alerting.
8. Is 99% accuracy realistic for real-world deployment?
It reflects strong performance on the benchmark datasets used, but the study cautions that such figures should be read alongside dataset-specific class imbalance and cross-dataset generalisation, rather than treated as a guarantee of identical performance on a live production network.
9. What attack types are hardest for the model to detect?
Rare classes such as infiltration attacks and certain web-attack subtypes showed noticeably lower recall, a direct consequence of having relatively few training examples for the model to learn from.
10. What would extend this research further?
Live deployment on a production network, integration with a security information and event management platform, and adversarial robustness testing against attackers deliberately trying to evade the model are all identified as natural next steps.
Purchase to unlock the full material.