Authors: Yashasvi Sharma, Amrish Kumar
Abstract: Signature-based security tools detect attacks they already know and are blind to zero-day attacks, while many machine learning intrusion detection systems still suffer from high false-positive rates and have been evaluated mainly on static, pre-recorded datasets. This paper presents an intelligent threat detection system that learns normal network behaviour, flags deviations from it, and combines supervised classifiers with an anomaly detector. A synthetic network-flow generator produces normal traffic, three known attack types (DoS flood, port scan, SSH brute force) and three attack types withheld from training (Slowloris, botnet beacon, data exfiltration). Four detectors are compared over five random runs on 18,000 test flows: signature rules, a Random Forest, an MLP neural network, and a hybrid of Random Forest, MLP and an Isolation Forest fitted on normal traffic. The hybrid detects 100% of known attacks and 68.4% of unseen attacks, against about 90% and 0.1% for signature rules, at a 3.0% false-alarm rate. Its gain is uneven: exfiltration is detected only 5% of the time. The results come from author-generated synthetic data, so they show the behaviour of the design rather than field performance. CICIDS2017, a CNN-LSTM model, SHAP explanations, detection-latency measurement and live traffic remain to be done and are not claimed. The contribution is a design and evaluation framework for detecting known and unknown attacks, not a new algorithm.
