Hybrid Machine Learning and XAI Approach for Real-Time Intrusion Detection

Abstract

The growth of communication technologies and advancement in cloud computing have led to an increase in the possibility of cybercrime and attacks. Traditional IDSs (Intrusion Detection Systems) are ineffective in detecting sophisticated attacks that evolve rapidly and target information systems and therefore do not provide sufficient protection. Moreover, traditional systems are slow to adapt to the appearance of new threats and produce a high number of false alarms which are often considered a nuisance. The proposed study offers an intrusion detection system framework that incorporates the hybrid techniques of machine learning to enhance the security of networks and detect cyber threats. The key aspects of the system are the following: the model uses various machine learning algorithms as well as anomaly detection methods in order to detect intrusions effectively. The effectiveness of the framework in terms of its accuracy, precision, recall, F1 score, and false positive index calculation is measured through conducting empirical testing applying public datasets as references for verification of the effectiveness of the proposed model. The results of the study show that the hybrid intrusion detection system manages to achieve better performance in comparison with conventional solitary models due to its adaptability, low computational complexity and ability to provide security in the context of rapidly evolving networks. The developed intrusion detection system aims to meet the rising demand for intelligent solutions which provide security for modern communication systems.

Introduction

The rapid development of digital technologies, including cloud computing, the Internet of Things (IoT), artificial intelligence (AI), and smart communication networks, has increased the complexity of cybersecurity threats. Traditional security mechanisms, such as firewalls and access control systems, often struggle to detect sophisticated, unknown, and zero-day attacks. Therefore, there is a growing need for intelligent Intrusion Detection Systems (IDS) that can identify malicious network activities in real time with high accuracy and fewer false alarms.

This study proposes a hybrid machine learning-based intrusion detection framework that combines traditional machine learning algorithms with deep learning techniques to improve network security. The framework aims to detect both known and unknown cyberattacks, enhance classification accuracy, reduce false positives, and support automated security responses.

The literature review highlights the effectiveness of machine learning and deep learning methods in identifying malicious network traffic. Algorithms such as Random Forest, Support Vector Machine (SVM), Gradient Boosting, Convolutional Neural Networks (CNN), and Long Short-Term Memory (LSTM) networks can recognize complex traffic patterns. Previous studies also emphasize the importance of feature selection, class balancing, and efficient processing to improve detection performance. However, challenges remain in detecting rare attacks, handling imbalanced datasets, reducing computational costs, and maintaining real-time performance.

The proposed methodology consists of four main stages:

1. Network traffic acquisition and preprocessing: Network traffic is collected from servers, routers, cloud platforms, and connected devices. Duplicate records, missing values, noise, and inconsistent formats are handled through data cleaning, normalization, encoding, and class-balancing techniques.

2. Feature extraction and optimization: Important statistical, temporal, and behavioural features, such as packet size, flow duration, transmission rate, and connection frequency, are extracted. Feature selection techniques, including Principal Component Analysis (PCA), correlation-based filtering, and Recursive Feature Elimination (RFE), are used to remove irrelevant attributes and improve efficiency.

3. Hybrid machine learning-based intrusion detection: Supervised algorithms, including Random Forest, SVM, and Gradient Boosting, are combined with deep learning models such as CNN and LSTM. These techniques analyze network traffic patterns, identify anomalies, and classify normal and malicious activities.

4. Intelligent threat analysis and security response: Detected attacks are classified according to their type and severity. The system generates real-time alerts and supports mitigation measures, including blocking suspicious traffic, terminating malicious sessions, restricting access, and updating firewall rules.

Conclusion

The outlined system is characterized by the combination of advanced preprocessing techniques, the most efficient methods for extracting meaningful features, ensemble machine learning algorithms, and deep learning approaches like CNN and LSTM platforms to establish effective and reliable detection of breaches. As per the experiment evaluation conducted on the benchmark datasets taking NSL-KDD, CICIDS2017, and UNSW-NB15 as references, it was discovered that the hybrid approach operates much better than conventional machines as well as independent deep learning techniques. The detection rate achieved by the hybrid system is noted to be equal to 97.30%, precision of 96.80%, and recall rate of 96.10%. Moreover, the proposed framework demonstrates the significant achievement in the attack-wise performance with the F1 scores achieving 96.80% for DoS/DDoS attacks, 96.10% for probing attacks, 96.40% for brute force attacks, 95.30% for R2L infringements, and 94.90% for U2R attacks. Besides, it was noted during the computation efficiency analysis that the new model has reduced the time of inference to 48 milliseconds as well as kept the model’s size compact (28.6 MB). The presented information regarding the stability showed the ability of the hybrid system to remain stable in noisy traffic, packet loss, and heterogeneous environments. Thus, the hybrid framework offers a realistic, scalable, and computing-efficient solution for cybersecurity in terms of modern communication systems. In the future, the framework may be enhanced by the introduction of elements of federated learning, explanatory AI, and blockchain-oriented threat intelligence.

References

[1] V. R, P. C. A and V. M, \"A Comprehensive Analysis of Intrusion Detection System using Machine Learning and Deep Learning Algorithms,\" 2024 International Conference on Intelligent Algorithms for Computational Intelligence Systems (IACIS), Hassan, India, 2024, pp. 1-5, doi: 10.1109/IACIS61494.2024.10721636. [2] R. Rehyadd and P. Agarwal, \"Performance Comparison of Machine Learning and Deep Learning Techniques for Detecting Network Intrusions,\" 2025 International Conference on Next Generation of Green Information and Emerging Technologies (GIET), Gunupur, India, 2025, pp. 1-7, doi: 10.1109/GIET65294.2025.11234882. [3] N. Rana, H. Alshehri, M. A. Abdali and W. A. Madkhali, \"Optimized Intrusion Detection System for Attack Classification Using Machine Learning and Deep Learning Techniques,\" 2024 Fifth International Confrence on Intelligent Data Science Technologies and Applications (IDSTA), DUBROVNIK, Croatia, 2024, pp. 158-163, doi: 10.1109/IDSTA62194.2024.10746943. [4] H. Xie, Y. Shao, Z. Li, Z. Alomari and A. Makanju, \"Optimization of Class Imbalance Techniques in Machine Learning Models for Network Intrusion Detection,\" 2025 9th International Conference on Cryptography, Security and Privacy (CSP), Okinawa, Japan, 2025, pp. 102-106, doi: 10.1109/CSP66295.2025.00025. [5] M. S. Rahman, W. Tausif Islam and M. R. Ahmed Khan, \"Enhancing Cybersecurity with an Investigation into Network Intrusion Detection System Using Machine Learning,\" 2024 IEEE 3rd International Conference on Robotics, Automation, Artificial-Intelligence and Internet-of-Things (RAAICON), Dhaka, Bangladesh, 2024, pp. 107-110, doi: 10.1109/RAAICON64172.2024.10928505. [6] S. Ning, K. Nguyen, S. Bagchi and Y. Park, \"The Study of Feature Engineering in Machine Learning and Deep Learning for Network Intrusion Detection Systems,\" 2024 Silicon Valley Cybersecurity Conference (SVCC), Seoul, Korea, Republic of, 2024, pp. 1-5, doi: 10.1109/SVCC61185.2024.10637359. [7] R. Sharma, V. Sharma, T. K. Vashishth, S. Chaudhary, K. K. Sharma and S. Kaushik, \"Securing Routing in MANETs: A Comprehensive Review of Enhanced Optimized Link State Routing (EOLSR),\" 2025 International Conference on Intelligent Computing and Knowledge Extraction (ICICKE), Bengaluru, India, 2025, pp. 1-6, doi: 10.1109/ICICKE65317.2025.11136709. [8] K. Madhusudhan and A. K. Madam, \"Performance Comparison of Network Intrusion Detection Machine Learning Models,\" 2025 International Conference on Sustainable Communication Networks and Application (ICSCN), Theni, India, 2025, pp. 67-71, doi: 10.1109/ICSCN67106.2025.11308467. [9] R. S. Valasev, A. R. Priambodo and R. N. Esti Anggraini, \"Evaluating Contemporary Machine Learning and Deep Learning Strategies for Intrusion Detection,\" 2024 IEEE International Conference on Control & Automation, Electronics, Robotics, Internet of Things, and Artificial Intelligence (CERIA), Bandung, Indonesia, 2024, pp. 1-5, doi: 10.1109/CERIA64726.2024.10915015. [10] V. Sharma and S. Kumar, \"Role of Artificial Intelligence (AI) to Enhance the Security and Privacy of Data in Smart Cities,\" 2023 3rd International Conference on Advance Computing and Innovative Technologies in Engineering (ICACITE), Greater Noida, India, 2023, pp. 596-599, doi: 10.1109/ICACITE57410.2023.10182455. [11] Y. M. Latha, J. Varsha, J. Rithika, J. Sanjana, J. Shrenika and K. Bhavana, \"ML Framework for Intrusion Detection in Cyber Networks,\" 2026 6th International Conference on Trends in Material Science and Inventive Materials (ICTMIM), Kanyakumari, India, 2026, pp. 1-3, doi: 10.1109/ICTMIM68190.2026.11507952. [12] A. Ajeesh and T. Mathew, \"Enhancing Network Security: A Comparative Analysis of Deep Learning and Machine Learning Models for Intrusion Detection,\" 2024 International Conference on E-mobility, Power Control and Smart Systems (ICEMPS), Thiruvananthapuram, India, 2024, pp. 1-6, doi: 10.1109/ICEMPS60684.2024.10559350. [13] V. Sharma, P. Chauhan, T. K. Vashishth, S. Kaushik, P. Rana and K. Chaudhary, \"Analyzing Vulnerabilities in Academic Network Servers: A Foundation for AI-Driven Intrusion Detection Systems,\" 2025 International Conference on Innovations and Emerging Technologies In AI & Communication Systems (IETACS), Mohali, India, 2025, pp. 1093-1098, doi: 10.1109/IETACS68750.2025.11385339. [14] T. K. Vashishth, M. Kumar, P. Chauhan, S. Kumar, J. Singh and V. Sharma, \"AI-Enhanced Intrusion Detection and Prevention Systems in the Age of Quantum Cyber Threats,\" 2025 IEEE 1st International Conference on Recent Trends in Computing and Smart Mobility (RCSM), Bhopal, India, 2025, pp. 1-6, doi: 10.1109/RCSM67767.2025.11507504.

Copyright

Copyright © 2026 Abhishek Kumar, Dilip Kumar. This is an open access article distributed under the Creative Commons Attribution License, which permits unrestricted use, distribution, and reproduction in any medium, provided the original work is properly cited.