Hybrid Signature-Based and Machine Learning Based Network Intrusion Detection

The increasing number of cyberattacks against computer networks has created a need for adaptable and effective Network Intrusion Detection System (NIDS). Traditional signature-based detection methods are effective at identifying known attack patterns but may fail in detecting new or modified attacks. On the other hand, machine learning-based anamoly detection can identify unusual network behaviour but may generate false positives when they are used independently. This research presents a hybrid Network Intrusion Detection System that combines signature-based detection with machine learning-based anamoly detection to address these limitations. The proposed system captures live network traffic or analyses previously recorded PCAP files, extracts relevant packet and flow-level features and processes the traffic through two parallel detection mechanisms. The signature engine identifies known threats using configurable attack rules while a Random Forest classifier is used to detect abnormal or potentially malicious traffic. Detected events are filtered, de-duplicated, logged and presented through a real-time Flask-based web dashboard. The system uses features such as packet length, TTL, payload size, protocol, source ports, destination ports and TCP flags for machine learning-based detection. The proposed hybrid approach aims to improve the coverage and practical usability of NIDS by combining the reliability of known attack signatures with the adaptability of machine learning-based anamoly detection.