ENHANCING INTRUSION DETECTION THROUGH HYBRID ANOMALY DETECTION: INTEGRATION OF MACHINE LEARNING MODELS WITH RULE-BASED STRUCTURE

Abstract

This paper offers a comprehensive hybrid intrusion detection system (IDS) which integrates signature-based threshold detection with machine learning-driven anomaly detection. The system is implemented as a cross-platform desktop application leveraging an Electron-based frontend with a Python backend for real-time monitoring and threat detection. The architecture employs numerous machine learning algorithms containing Random Forest, XG Boost and Support Vector Machines alongside traditional threshold-based detection mechanisms to identify network intrusions and host-based anomalies. The system demonstrates the effectiveness of combining multiple detection methodologies to enhance intrusion detection capabilities while keeping computational competence through optimized threading and alert deduplication mechanisms.