Asian Basic and Applied Research Journal

As network traffic increases, intrusion detection systems face complex challenges in distinguishing normal flows from abnormal flows. This study used four machine learning models to detect cyberattacks: Logistic Regression (LR), Linear Support Vector Machine (SVM), Decision Tree (DT), and Random Forest (RF). A synthetic benchmark dataset was created, comprising 50,000 network flows characterised by 15 features, including packet counts, flow size, time-to-live (TTL), load, jitter, protocol, service, and connection status. These are typical characteristics of intrusion detection datasets. The data included 29,000 normal flows and 21,000 attack flows, with the latter comprising Generic, Exploits, Fuzzers, Denial of Service (DoS) and Reconnaissance attacks. The data were divided into training, validation and test sets. The best-performing model was Random Forest, achieving an accuracy of 96.87%, precision of 97.40%, recall of 95.08%, F1-score of 0.962, ROC-AUC of 0.995 and false-positive rate of 1.84%. All DoS and Reconnaissance attacks were detected, while Generic, Exploits and Fuzzers attacks achieved recall values of 99.10%, 89.59% and 84.31%, respectively. Destination packet count and source TTL were the most important features. Overall, these results demonstrate the effectiveness of ensemble learning techniques for network intrusion detection in the controlled benchmark.