New Model for Analyzing Network Attacks to Protect Educational System Networks

Digital transformation has increased the dependence of educational institutions on reliable computer networks and secure information services. In Iraq, this development strengthens the need to protect institutional resources against malicious traffic while maintaining access for legitimate users. The problem addressed in this study is the accurate classification of normal network activity and multiple categories of cyberattacks. An intrusion detection framework based on extreme gradient boosting is proposed to analyze network flows through supervised machine learning. The framework incorporates data cleaning, missing-value treatment, label encoding, feature normalization, feature engineering, model training, and performance evaluation. Experiments use the intrusion detection benchmark released by the Canadian Institute for Cybersecurity in 2017, with eighty percent of the working data allocated to training and twenty percent to testing. The reported results show an accuracy of 98.70%, precision of 98.41%, recall of 99.11%, and a harmonic mean of precision and recall of 98.76%. These findings indicate promising classification performance and a useful balance between identifying attacks and maintaining prediction precision within the evaluated data. The results support further investigation of boosted decision trees for educational network protection. However, aggregate performance does not establish detection quality for every attack category or effectiveness in a live institutional environment. Further work should document class-level performance, clarify experimental settings, and evaluate representative educational network traffic before operational deployment.