A Lightweight and Explainable Machine Learning Framework Network Intrusion Detection and Monitoring

This paper has presented the design of a lightweight and explainable web-based intrusion detection system that jointly targets false-positive reduction, minority-class detection, computational efficiency, decision interpretability, and cross-dataset generalization — properties that the reviewed literature typically addresses only individually. The proposed methodology combines Mutual Information/Random Forest feature selection, SMOTE-based class balancing, a comparative evaluation of Decision Tree, Random Forest, and XGBoost classifiers, SHAP-based explainability, a derived risk-scoring function, a Flask-based real-time web dashboard, and an explicit cross-dataset evaluation protocol using CICIDS2017 and UNSW-NB15. Execution of the described experiments and reporting of the resulting quantitative metrics constitute the immediate next phase of this work.

[1] I.Sharafaldin, A. H. Lashkari, and A. A. Ghorbani, “Toward Generating a New Intrusion Detection Dataset and Intrusion Traffic Characterization,” in Proc. 4th Int. Conf. Information Systems Security and Privacy (ICISSP), Funchal, Portugal, Jan. 2018, pp. 108–116. [2] N. Moustafa and J. Slay, “UNSW-NB15: A comprehensive data set for network intrusion detection systems (UNSW-NB15 network data set),” in Proc. Military Communications and Information Systems Conf. (MilCIS), Canberra, Australia, 2015, pp. 1–6. [3]  L. Breiman, “Random Forests,” Machine Learning, vol. 45, no. 1, pp. 5–32, 2001. [4] T. Chen and C. Guestrin, “XGBoost: A Scalable Tree Boosting System,” in Proc. 22nd ACM SIGKDD Int. Conf. Knowledge Discovery and Data Mining, 2016, pp. 785–794. [5] N. V. Chawla, K. W. Bowyer, L. O. Hall, and W. P. Kegelmeyer, “SMOTE: Synthetic Minority Over-sampling Technique,” J. Artificial Intelligence Research, vol. 16, pp. 321–357, 2002. [6] Y. G. Damtew and H. Chen, “SMMO-CoFS: Synthetic Multi-minority Oversampling with Collaborative Feature Selection for Network Intrusion Detection System,” Int. J. Computational Intelligence Systems, vol. 16, no. 1, pp. 1–20, Feb. 2023. [7]     R. Kaur, “Harnessing Decision Tree-guided Dynamic Oversampling for Intrusion Detection,” Engineering, Technology & Applied Science Research, 2024. [8]   F. Amiri, M. RezaeiYousefi, C. Lucas, A. Shakery, and N. Yazdani, “Mutual information-based feature selection for intrusion detection systems,” J. Network and Computer Applications, vol. 34, no. 4, pp. 1184–1199, 2011. [9] H. P. Vinutha and P. Basavaraju, “Analysis of Feature Selection and Ensemble Classifier Methods for Intrusion Detection,” Int. J. Natural Computing Research, vol. 7, no. 1, pp. 57–72, 2018. [10]   S. M. Lundberg and S.-I. Lee, “A Unified Approach to Interpreting Model Predictions,” in Proc. 31st Int. Conf. Neural Information Processing Systems (NeurIPS), 2017, pp. 4765–4774.