DESIGN AND DEVELOPMENT OF A NETWORK INTRUSION DETECTION SYSTEM USING MACHINE LEARNING

Traditional signature-based intrusion detection systems are inadequate against evolving cyber threats. Machine learning-based Network Intrusion Detection Systems (NIDS) offer adaptive solutions through pattern recognition and traffic behavior analysis; however, comprehensive comparative studies remain limited. This study evaluates four machine learning models Random Forest (RF), Naïve Bayes (NB), Support Vector Machine (SVM), and K-Nearest Neighbors (KNN) alongside an ensemble method, using the CIC-IDS2017 dataset. Preprocessing, feature correlation analysis, and stratified 80/20 train-test splitting were applied, with performance assessed through confusion matrices, ROC-AUC, and precision-recall metrics. Results show that Random Forest achieved ≈96% accuracy with strong precision and recall for high-volume attacks such as DDoS and Port Scan. Naïve Bayes performed adequately on simple attacks but failed on infiltration traffic, while SVM reached an F1-score of ≈93% though at high computational cost. KNN proved effective on Brute Force detection but declined with high-dimensional data. The ensemble model achieved the best performance (≈97% accuracy, ROC–AUC 0.97), notably improving recall on minority classes such as Infiltration and Brute Force. These findings highlight the superiority of ensemble-based approaches for modern NIDS, demonstrating that hybrid, multi-model architectures provide higher detection accuracy and resilience against diverse attack types.