MULTI-CLASS INTRUSION DETECTION SYSTEM USING MACHINE LEARNING⁠ ON CICIDS201⁠7 DATASET

Abstract

Modern cybersecurity risks have been significantly increased by the exponential growth of worldwide internet connectivity and digital cloud communications. Aggressive threat vectors, such as volumetric denial of service (DoS), distributed denial of service (DDoS), systematic brute-force extraction, and sophisticated web-layer application exploits, pose a high-density threat to enterprise network infrastructures. Conventional security perimeters mostly rely on legacy signature-matching algorithms, which are only effective against known malware lineages and entirely break when exposed to zero-day configurations. To circumvent these legacy barriers, this project⁠ presents an advanced Machi⁠ne Learningbased Network Intrus⁠io⁠n Detection System (NIDS) utilizing the comprehensive, high-fidelity CICIDS2017 database framework.The engineered platform uses a two-stage analytical engine: an optimized multi-class taxonomic classifier designed to map verified anomalies into precise three groups, and a high-velocity binary filter configured to separate standard benign operational traffic from generic anomalies.In order to prevent statistical bias in downstream loops, the implementation phase enforces strict data-cleansing pipelines, handles structural missing variables, eliminates low-variance administrative columns, and applies robust mathematical feature normalization along with databalancing strategies. Multiple predictive algorithms—including⁠ Random Forest Ensembles, Gradient Boost⁠in⁠g⁠ Mach⁠ines,⁠ an⁠d margin-maximized Support Vector⁠ Machines (SVM)—are systemat⁠ically executed and cr⁠oss⁠-validated .Tree-based bagging and boosting configurations provide outstanding diagnostic metrics, achieving classification accuracies above 99.7% in both classification layers, significantly outperforming single-hyperplane models, according to empirical performance assessment parameters. Lastly, a Flask application server layer is used to elevate the improved classification module into a working micro-hosting application container. This enables network security operations teams to view real-time threat identification warnings on a consolidated web interface and securely stream tabular network flows. In the end, this system shows how incorporating multi-model machine learning analytics optimizes corporate defensive postures against both extremely fluid and structured digital network anomalies..