From Flow to Packet: A Unified Machine Learning Approach for Advanced Intrusion Detection

In the era of advanced networking with 5G integration, the need for efficient and scalable intrusion detection systems has become critical to securing large‐scale digital infrastructures. Traditional intrusion detection approaches either analyze individual packets yielding high computational costs or rely solely on flow‐based data, which can miss important sequence‐level information critical to identifying interservice communications and attack behaviors. To address this, we propose a unified machine learning approach that integrates flow‐based and packet‐based detection using convolutional neural networks (CNNs) for advanced intrusion detection. Our method prioritizes flow‐based detection for short flows as the first defense layer and selectively invokes packet‐based detection for longer flows or cases deemed uncertain. Uncertain predictions from the flow‐based stage are identified using a confidence threshold and re‐evaluated by the packet‐based system. We validate our method using a systematically generated dataset from a microservices environment alongside benchmark datasets, including CIC‐IDS‐2017, CIC‐IDS‐2018, and CREMEv2. This hybrid detection strategy yields strong performance in both accuracy and efficiency. Specifically, our approach reduces the computational cost by up to 24 × (approximately 1.38 orders of magnitude) compared to relying solely on packet‐based analysis. Additionally, the model demonstrates strong generalization with detection rates of 95% and 100% for flow‐ and packet‐based detection, respectively, even against previously unseen attacks generated through behavioral variations and command‐level perturbations.