Machine Learning-Based Open-Source Framework for Real-Time Network Intrusion Detection

초록

The rapid increase in internet usage has led to a surge in network threats, making traditional signature-based intrusion detection systems (IDS) less effective. This paper presents a machine learning-based, open-source framework designed for real-time detection of malicious network traffic. The proposed system uses a flowmeter to extract time and size-based features from network traffic, followed by a preprocessing pipeline that enhances detection accuracy. After evaluating various models, the deep belief network (DBN) was selected for its superior performance, achieving a weighted F1 score of 99.83 and a prediction time of 2.57 s. To improve scalability and efficiency, the framework integrates with the Wazuh security information and event management (SIEM) system, enabling real-time alerts and flexible deployment across networks. Simulations conducted using graphical network simulator-3 (GNS3) confirm the framework's effectiveness in real-time intrusion detection.

키워드