SecureNetIDS: A Multi-Stage Machine Learning Model for Intrusion Detection

Abstract

SecureNetIDS is a multi-stage intrusion detection system, which makes use of machine learning (ML), deep learning (DL), hybrid classification, and feature selection to recognize various cyberattacks with high accuracy and strength. The architecture proposed includes four consecutive steps, which include data preprocessing, optimizing features, hierarchical detection, and the ultimate decision fusion. The hybrid filter-wrapper selection strategy is used in the feature optimization step and the most discriminative attributes are identified, which minimizes the dimensionality and the computational costs and at the same time maintains the essential attack patterns. The detection pipeline combines both conventional ML models and DL architecture in a hybrid ensemble that brings together the complementary advantages of the two to detect known as well as the zero-day intrusion. SecureNetIDS is tested and assessed on three popular benchmark datasets, NSL-KDD, CICIDS2017, and UNSW-NB15 so that it can be applied uniformly to both older and more recent network traffic conditions. It is proven experimentally that the proposed model is highly accurate, precise, recalls and F1-scores, and it reduces the false alarm rates much lower than traditional single-stage IDS and independent ML/DL methods. The multi-stage hybrid design too improves scalability and flexibility to changing network behaviors. Generally, SecureNetIDS is a powerful, feature sensitive, and dataset independent next generation intrusion detection system in dynamic and heterogeneous systems.