Submit your papersSubmit Now
For Enquiries: [email protected]
IIARD LogoIIARD

Enhanced Machine Learning-Based Intrusion Detection System for Zero-Day Attacks

Ue-Bee, Kakuubari Promise, Sako, D.J.S, Nwiabu, N. D

Abstract

The recent rise in complex cyber-attacks has led to the need for intrusion detection systems that can detect both known and previously unseen attacks in network traffic with minimal false positives. This paper presents Enhanced Machine Learning Based Intrusion Detection System for Zero-Day Network Attacks as a solution to the problem of zero-day attack detection with minimal false positives. The proposed model uses a hybrid detection architecture that comprises of Signature-Based Detection, Random Forest classifier, Confidence Gate, and MiniBatch K-Means clustering to detect both known and zero-day attacks respectively. The intrusion detection system was designed and implemented using Python and CICIDS2017 dataset was used for training and evaluating the proposed models. The experimental results showed that Random Forest attained an accuracy of 99.59 % with a precision of 99.58%, a recall of 99.59%, and an F1-score of 99.58%. On the other hand, MiniBatch K-Means attained a Silhouette Score of 0.8989%. This demonstrated that that signature-based detection rules coupled with supervised and unsupervised machine learning algorithms could effectively detect known attacks and suspicious activities. The prototype was able to monitor live network traffic and present dashboards with visualizations of security- related events.

Keywords

Intrusion detection systemzero-day attackRandom ForestMiniBatch K-Meanshybrid detectionSecurity Operations Center; MITRE ATT&CK

References

Ahmad, Z., Khan, A. S., Shiang, C. W., Abdullah, J., & Ahmad, F. (2021). Network intrusion detection system: A systematic study of machine learning and deep learning approaches. Transactions on Emerging Telecommunications Technologies, 32(1), e4150. Ali, T. E., Chong, Y. W., & Manickam, S. (2023). Comparison of machine learning and deep learning approaches for detecting DDoS attacks in software-defined networking. Applied Sciences, 13(5), 3033. Arreche, O., Bibers, I., & Abdallah, M. (2024). A two-level ensemble learning framework for enhancing network intrusion detection systems. IEEE Access. Awotunde, J. B., Ayo, F. E., Panigrahi, R., Garg, A., Bhoi, A. K., & Barsocchi, P. (2023). A multi-level random forest model-based intrusion detection using fuzzy inference system for Internet of Things networks. International Journal of Computational Intelligence Systems, 16, Article 31. https://doi.org/10.1007/s44196-023-00205-w Chen, Z., Simsek, M., Kantarci, B., Bagheri, M., & Djukic, P. (2024). Machine learning-enabled hybrid intrusion detection system with host data transformation and an advanced two-stage classifier. Computer Networks, 250, 110576. https://doi.org/10.1016/j.comnet.2024.110576 Dai, Z., Por, L. Y., Chen, Y.-L., Yang, J., Ku, C. S., Alizadehsani, R., Pławiak, P., & Acharya, U. R. (2024). An intrusion detection model to detect zero-day attacks in unseen data using machine learning. PLOS ONE, 19(9), e0308469. https://doi.org/10.1371/journal.pone.0308469 Danso, P. K., Neto, E. C. P., Dadkhah, S., Zohourian, A., Molyneaux, H., & Ghorbani, A. A. (2022). Ensemble-based intrusion detection for Internet of Things devices. In Proceedings of the IEEE HONET Conference. 34–39. Ferrag, M. A., Maglaras, L., Moschoyiannis, S., & Janicke, H. (2023). Deep learning for cyber security intrusion detection: Approaches, datasets, and future research directions. Computer Networks, 225, 109653. Flask Development Team. (2025). Flask documentation. Guo, Y. (2023). A review of machine learning-based zero-day attack detection: Challenges and future directions. Computer Communications, 198, 175–185. https://doi.org/10.1016/j.comcom.2022.11.001 Maseer, Z. K., Yusof, R., Bahaman, N., Mostafa, S. A., & Foozy, C. F. M. (2021). Benchmarking of machine learning for anomaly-based intrusion detection systems in the CICIDS2017 dataset. IEEE Access, 9, 22351–22370. https://doi.org/10.1109/ACCESS.2021.3056614 MITRE Corporation. (2025). MITRE ATT&CK knowledge base. Neto, H. S., Lacerda, W. S., & Françozo, R. V. (2021). Random forests for online intrusion detection in computer networks. Journal of Computer Science, 17(10), 905–914. https://doi.org/10.3844/jcssp.2021.905.914 NIST. (2024). Cybersecurity Framework 2.0. National Institute of Standards and Technology. Sajid, M., Malik, K. R., Almogren, A., Malik, T. S., Khan, A. H., Tanveer, J., & Ur Rehman, A. (2024). Enhancing intrusion detection: A hybrid machine and deep learning approach. Journal of Cloud Computing, 13, Article 123. https://doi.org/10.1186/s13677-024-00685-x IJCSMT Sharafaldin, I., Habibi Lashkari, A., & Ghorbani, A. A. (2018). Toward generating a new intrusion detection dataset and intrusion traffic characterization. In Proceedings of the 4th International Conference on Information Systems Security and Privacy (pp. 108–116). SciTePress. https://doi.org/10.5220/0006639801080116 Talaei Khoei, T., & Kaabouch, N. (2023). A comparative analysis of supervised and unsupervised models for detecting attacks on the intrusion detection systems. Information, 14(2), 103. https://doi.org/10.3390/info14020103 Visuvanathan, G. E., Sayeed, M. S., & Yogarayan, S. (2025). BHFVAL: Blockchain-enabled hierarchical federated variational autoencoder framework for secure intrusion detection in vehicular networks. Scientific Reports, 15, 45742.