AI-Powered Intrusion Detection Systems

Abstract

Artificial intelligence-based intrusion detection systems have been broadly applied to combat the rise in sophistication of network attacks. The objective of the development task was to explore how machine learning algorithms can be utilized to detect anomalies and malicious patterns in network traffic. The objective was also to examine how well these models performed on various publicly available benchmark datasets. The experimentation involved using four datasets—NSL-KDD, UNSW-NB15, CICIDS2017, and ToN_IoT—that represent different network environments and attack profiles. A comprehensive pipeline was developed to preprocess the data, carry out dimen-sionality reduction, train a range of machine learning and deep learning models, and compare and evaluate their binary and multiclass classification performance. The models tried were Random Forest, Logistic Regression, Support Vector Machine, k-Nearest Neighbors, Decision Tree, Multi-layer Perceptron, and Long Short-Term Memory networks. Highly accurate binary classification was achieved for all the datasets, in most instances above 95%, with Random Forest and LSTM models performing optimally. Multiclass classification strug-gled with class imbalance, especially in detecting rare attack types such as U2R and Infiltration, with some models having near-zero recall for those classes. Overall detection rates for majority classes remained good in spite of this. Dimensionality reduction and ensemble learning methods were found to enhance performance while increasing computational efficiency. The findings con-firmed the feasibility of AI-powered IDS, particularly when models were tailored to dataset charac-teristics and extended with balanced feature engineering. The takeaway was that while traditional models can be as good as deep learning models in structured network data, hybrid learning strat-egies and explainable AI techniques are promising areas for continued research and real-world implementation.