AI-Based Intrusion Detection System (IDS) for Signature Recognition Using Machine Learning and Network Simulation

Abstract

The exponential rise in cyber threats has created a critical need for intelligent and adaptive intrusion detection systems (IDS) capable of identifying both known and emerging attack patterns. Traditional rule-based IDS mechanisms, such as Snort, rely heavily on predefined signatures and struggle against sophisticated attacks including port scanning, web-based exploits, and distributed denial-of-service (DDoS) attacks. This paper presents an AI-based Intrusion Detection System that integrates network simulation, machine learning, and real-time visualization into a unified three-layer framework. The NS-3 network simulator generates realistic normal and malicious traffic between attacker, router, and victim nodes; the resulting packet-capture (PCAP) data is processed by a Python-based IDS engine that applies signature rules for port scanning, DoS flooding, and web attacks (SQL Injection, XSS, LFI, command injection); and a Random Forest classifier, trained on the CIC-IDS2017 benchmark dataset, augments detection with machine-learning-based classification. A Flask-based web dashboard provides real-time visualization of alerts, packet statistics, and attack distribution. Experimental results show an average detection accuracy of 98.5%, an average F1-score of 97.7%, and a false-positive rate below 1.2%, outperforming rule-based and prior deep-learning baselines on comparable attack categories. The proposed multi-layered architecture demonstrates that combining simulation, machine learning, and visualization can produce a scalable and effective solution for modern network security challenges.

Introduction

The text presents an integrated AI-based Intrusion Detection System (IDS) designed to detect both known and evolving cyber-attacks in enterprise networks.

• Problem: Traditional rule- and signature-based IDS tools such as Snort require frequent manual updates and struggle to detect zero-day attacks and new attack variants.
• Proposed solution: The system combines NS-3 network simulation, signature-based detection, Random Forest machine learning, and a Flask-based real-time dashboard into one framework.
• NS-3 simulation: A three-node network consisting of an attacker, router, and victim/server is created using a 100 Mbps CSMA connection. TCP and UDP traffic are generated to represent normal and malicious behavior, while PCAP files capture network traffic.
• Signature-based IDS: A Python/Scapy engine detects attacks using predefined rules for port scanning, DoS flooding, web attacks, and ICMP/ARP flooding. Detected events are recorded with attack type, source IP, signature, and timestamp.
• Machine learning: A Random Forest classifier is trained using selected features from the CIC-IDS2017 dataset to distinguish benign and malicious network flows. Unlike fixed signatures, the ML component can generalize to previously unseen traffic patterns.
• Web dashboard: A Flask interface provides real-time alerts, attack-type charts, IDS scanning, CSV export, port-simulation controls, and alert reset functions.
• Dataset: CIC-IDS2017 contains more than three million flow records across multiple attack categories. Ten relevant flow-level features were selected for model training.
• Results: The Random Forest achieved:
  • 98.5% average accuracy
  • 97.7% average F1-score
  • Less than 1.2% false-positive rate
  • Approximately 18 ms inference time
  • 99.0% F1-score for PortScan
  • 96.2% F1-score for Web Attacks
  • 97.9% F1-score for DoS attacks
• Signature detection: The system successfully identified five different web attacks, including SQL injection, XSS, local file inclusion, and command injection.
• Overall performance: The complete traffic-generation-to-dashboard pipeline operates in approximately two seconds, making the system suitable for near-real-time monitoring.

Conclusion

This work presented a three-layer AI-based Intrusion Detection System combining NS-3 network simulation, a Python signature-detection engine, a Random Forest classifier trained on CIC-IDS2017, and a Flask real-time dashboard. The system achieved 98.5% accuracy and 97.7% F1-score with a false-positive rate under 1.2%, successfully detecting port scanning, web-based attacks, and DoS/DDoS flooding within a controlled simulated environment. Future work includes replacing the Random Forest classifier with sequence-aware deep learning models (LSTM/BiLSTM) to better capture temporal attack patterns; bridging NS-3 to live traffic via TapBridge for hybrid real-world evaluation; extending training to CIC-IDS2018 and additional attack categories such as botnets and brute-force; incorporating explainable AI (SHAP/LIME) for alert transparency; and scaling the simulation to larger, distributed topologies.

References

[1] Sharafaldin, A. H. Lashkari, and A. A. Ghorbani, \"Toward Generating a New Intrusion Detection Dataset and Intrusion Traffic Characterization,\" in Proc. ICISSP, 2018, pp. 108–116. [2] C. Yin, Y. Zhu, J. Fei, and X. He, \"A Deep Learning Approach for Intrusion Detection Using Recurrent Neural Networks,\" IEEE Access, vol. 5, pp. 21954–21961, 2017. [3] A. L. Buczak and E. Guven, \"A Survey of Data Mining and Machine Learning Methods for Cyber Security Intrusion Detection,\" IEEE Commun. Surveys Tuts., vol. 18, no. 2, pp. 1153–1176, 2016. [4] G. F. Riley and T. R. Henderson, \"The ns-3 Network Simulator,\" in Modeling and Tools for Network Simulation, Berlin: Springer, 2010, pp. 15–34. [5] M. A. Hasan et al., \"Feature Selection for Intrusion Detection Using Random Forest,\" J. Inf. Security, vol. 7, pp. 129–140, 2016. [6] Canadian Institute for Cybersecurity, \"CICIDS2017 Dataset,\" 2017. [Online]. Available: https://www.unb.ca/cic/datasets/ids-2017.html [7] A. Divekar et al., \"Benchmarking Datasets for Anomaly-Based Network Intrusion Detection,\" in Proc. ICIT, 2018, pp. 1–6. [8] B. B. Zarpelao et al., \"A Survey of Intrusion Detection in Internet of Things,\" J. Netw. Comput. Appl., vol. 84, pp. 25–37, 2017.

Copyright

Copyright © 2026 T. Senthil, V. Shanmuganeethi. This is an open access article distributed under the Creative Commons Attribution License, which permits unrestricted use, distribution, and reproduction in any medium, provided the original work is properly cited.