Home / Current Issue / Paper 1723830
AI-Based Network Intrusion Detection System Using Machine Learning and Explainable AI
Subject area: Science,Engineering and Technology · Area of research: AI, Machine Learning
DOI: 10.64388/IREV10I4-1723830
Abstract
Network intrusion detection is an important cybersecurity function because network traffic can contain benign activity as well as malicious behavior. This paper presents an AI-based Network Intrusion Detection System (AI-NIDS) that combines live packet capture, flow generation, machine-learning classification, explainable artificial intelligence, and web-based visualization. The prototype is implemented in an Ubuntu virtual machine hosted through VirtualBox. Scapy captures traffic visible on the virtual network interface, and related packets are grouped into flows. Four features that can be derived directly from live traffic—destination port, packet count, total bytes, and average packet size—are used by the live classification pipeline. CICIDS2017 is used for model training and evaluation. Isolation Forest is used for anomaly-oriented analysis, while Random Forest and XGBoost perform multi-class classification. SHAP provides feature-level explanations, and a Flask dashboard presents live flows, detections, and explanations. On a held-out test set of 22,339 samples, Random Forest achieved 90.67% accuracy and XGBoost achieved 94.42% accuracy; macro F1 scores were 0.78 and 0.81, respectively. The results demonstrate the feasibility of combining machine learning and explainability in a practical NIDS prototype, while highlighting limitations related to reduced live features, rare attack classes, false positives, and virtualized network scope.
Keywords
network intrusion detection; machine learning; CICIDS2017; random forest; XGBoost; isolation forest; SHAP; explainable AI
References
[1] Sharafaldin I, Lashkari AH, Ghorbani AA. Toward generating a new intrusion detection dataset and intrusion traffic characterization. In: Proc. 4th International Conference on Information Systems Security and Privacy (ICISSP). 2018. p. 108–116.
[2] Breiman L. Random forests. Machine Learning. 2001;45:5–32.
[3] Chen T, Guestrin C. XGBoost: A scalable tree boosting system. In: Proc. 22nd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining. 2016. p. 785–794.
[4] Liu FT, Ting KM, Zhou ZH. Isolation forest. In: Proc. Eighth IEEE International Conference on Data Mining. 2008. p. 413–422.
[5] Lundberg SM, Lee SI. A unified approach to interpreting model predictions. In: Advances in Neural Information Processing Systems 30. 2017. p. 4765–4774.
How to cite this paper
@article{1723830,
author = {Ankitha Hiremath, B Shravani, Shreeraksha M R, Vanitha S H, Deepti N N},
title = {AI-Based Network Intrusion Detection System Using Machine Learning and Explainable AI},
journal = {Iconic Research And Engineering Journals},
year = {2026},
volume = {10},
number = {4},
pages = {1577-1583},
issn = {2456-8880},
url = {https://www.irejournals.com/formatedpaper/1723830.pdf},
abstract = {Network intrusion detection is an important cybersecurity function because network traffic can contain benign activity as well as malicious behavior. This paper presents an AI-based Network Intrusion Detection System (AI-NIDS) that combines live packet capture, flow generation, machine-learning classification, explainable artificial intelligence, and web-based visualization. The prototype is implemented in an Ubuntu virtual machine hosted through VirtualBox. Scapy captures traffic visible on the virtual network interface, and related packets are grouped into flows. Four features that can be derived directly from live traffic—destination port, packet count, total bytes, and average packet size—are used by the live classification pipeline. CICIDS2017 is used for model training and evaluation. Isolation Forest is used for anomaly-oriented analysis, while Random Forest and XGBoost perform multi-class classification. SHAP provides feature-level explanations, and a Flask dashboard presents live flows, detections, and explanations. On a held-out test set of 22,339 samples, Random Forest achieved 90.67% accuracy and XGBoost achieved 94.42% accuracy; macro F1 scores were 0.78 and 0.81, respectively. The results demonstrate the feasibility of combining machine learning and explainability in a practical NIDS prototype, while highlighting limitations related to reduced live features, rare attack classes, false positives, and virtualized network scope.},
keywords = {network intrusion detection; machine learning; CICIDS2017; random forest; XGBoost; isolation forest; SHAP; explainable AI},
month = {October},
doi = {https://doi.org/10.64388/IREV10I4-1723830}
}