An Automated Network Intrusion Detection and Identification System by Synergizing AI Techniques

Currently, cybercrimes are a serious threat to computer networks. Researchers have come to view Network Intrusion Detection Systems as a critical defensive component and have worked to develop new methods to detect hostile network activity. However, unknown attacks are difficult to detect on a zero-day basis. Previous studies addressed detection or identification techniques using binary classifications of attacks. In this paper, we introduce a system for the detection and identification of network intrusions that combines the strengths of the misuse and anomaly detection techniques. Our approach integrates a Gaussian Mixture Model, identify attacks resembling normal distributions enhances early detection capability, for anomaly detection at zero day and supervised models for identification of known attacks. After that, we evaluated our system using the CICIDS2017 and CICIDS2018 datasets, focusing on unsupervised learning for initial attack detection and supervised learning for multiclass classification. Our empirical findings highlight superior performance in terms of accuracy and F1 score, underscoring the effectiveness of our proposed system.