Intelligent Network Intrusion Detection System using
Machine Learning
Aditya Pandey Enrollment No.: E23CSEU0180
Abhiman Singh Saharan Enrollment No.: E23CSEU0174
Ridhima Dhanuka Enrollment No.: E23CSEU015
September 4, 2025
Abstract
With the increasing volume and sophistication of cyber threats, traditional signature-based secu-
rity systems are often insufficient. This project aims to develop an intelligent Network Intrusion
Detection System (NIDS) capable of identifying malicious network traffic in real-time. By apply-
ing supervised machine learning algorithms, the system will learn to distinguish between normal
network connections and various types of cyber-attacks, such as Denial-of-Service (DoS) and prob-
ing. This project will involve a comparative analysis of several classification models to determine
the most effective approach for accurately detecting intrusions, thereby showcasing a practical
application of machine learning in enhancing network security.
Proposed Methodology
The methodology will be executed as follows:
1. Data Preprocessing and Feature Engineering: Convert categorical features (e.g., pro-
tocol type, service) into numerical format using one-hot encoding. Scale numerical features
and split dataset into training/testing sets.
2. Model Implementation and Training: Implement multiple classifiers for comparison:
• Logistic Regression (baseline)
• Decision Tree & Random Forest (non-linear handling)
• Support Vector Machine (high-dimensional spaces)
• K-Nearest Neighbors (non-parametric approach)
3. Evaluation and Comparison: Train models on preprocessed data and evaluate using
Accuracy, Precision, Recall, and F1-Score. Generate confusion matrices to analyze
classification performance across attack types (e.g., normal, DoS, probe).
Dataset Information
The project uses the NSL-KDD dataset, a refined version of the classic KDD’99 dataset.
• Source: Canadian Institute for Cybersecurity (University of New Brunswick), also available
on Kaggle: [Link]
• Contents: Each record has 41 features, labeled as “normal” or attack (e.g., DoS, probe).
Features describe TCP connection properties such as duration, protocol type, service, and
traffic statistics. Well-suited for intrusion detection research.
