AI-Driven Network Intrusion Detection System and Automated Threat Response Using Machine Learning

AI-Driven Network Intrusion Detection System and Automated Threat Response Using Machine Learning

IEEE BASE PAPER TITLE:

DMGCRL: Dynamic Multi-Scale Graph Contrastive Representation Learning For Network Intrusion Detection

IEEE BASE PAPER ABSTRACT:

Graph neural networks (GNNs) have recently attracted significant attention in network intrusion detection systems (NIDS) due to their ability to model network traffic as graphs and capture complex relationships within network flows. However, existing GNN-based methods face critical limitations: they rely on limited or noisy labeled data and struggle to detect threats at various scales, ranging from local anomalies (e.g., port scanning) to coordinated subnetwork attacks (e.g., botnets) and global network-wide campaigns (e.g., DDoS attacks). To bridge this gap, we propose Dynamic Multiscale Graph Contrastive Representation Learning (DMGCRL), a self-supervised framework that hierarchically models network intrusions at different levels. At the node level, DMGCRL constructs structure-aware subnetworks around individual traffic flows to capture fine-grained behavioral deviations. For subnetwork-level threats, it employs substructure-aware pooling to identify coordinated anomalies among clustered malicious nodes. Finally, at the global level, DMGCRL derives representations that reflect the holistic state of the network, enabling detection of large-scale threats, such as distributed malware propagation. DMGCRL designs a shared GNN encoder with a multi-level contrastive loss to align multiscale representations while largely eliminating label dependence. It learns discriminative features from unlabeled traffic, refines decision boundaries without supervision, and reveals anomalies by contrasting related and unrelated nodes across scales. Performance evaluation was conducted on five publicly available network traffic datasets for binary and multiclass detection. Results show that DMGCRL consistently outperforms SOTA methods, achieving an F1 score of 99.86% on NF-CSE- CIC-IDS2018-V2 and 96.11% on NF-UNSW-NB15-V2 under binary detection and the lowest mean false positive rates, 1.28% and 2.33% under multiclass detection on the two datasets.

PROJECT OUTPUT VIDEO:

ALGORITHM / MODEL USED:

Random Forest, Decision Tree, KNN

OUR PROPOSED PROJECT ABSTRACT:

Network security has become an essential requirement for protecting modern digital infrastructures from unauthorized access, malicious activities, and network-based attacks. As the volume and complexity of network traffic continue to increase, conventional security mechanisms may require intelligent traffic analysis techniques to identify suspicious activities efficiently. A Network Intrusion Detection System (NIDS) provides an important layer of network security by analyzing network traffic characteristics and detecting patterns associated with cyber attacks such as Denial of Service (DoS), Port Scanning, Remote-to-Local (R2L), and User-to-Root (U2R) attacks. Therefore, there is a need for an intelligent security system that can not only identify potential intrusions but also provide an automated response to detected threats.

The proposed project, AI-Driven Network Intrusion Detection System and Automated Threat Response Using Machine Learning, presents a web-based intelligent security framework developed using Python, HTML, CSS, JavaScript, Flask, and SQLite. The system applies machine learning techniques to analyze network traffic attributes and classify network activities as normal or malicious. The NSL-KDD benchmark dataset is used for developing and evaluating the machine learning models. To provide efficient and simplified real-time prediction, the system focuses on twelve essential network parameters, including source and destination bytes, connection flags, protocol type, network service, connection count, same-service rate, different-service rate, destination host service count, connection duration, login status, and guest login status. Remaining background features are completed using baseline median values during prediction.

Multiple machine learning classifiers, including Random Forest, Decision Tree, and K-Nearest Neighbors (KNN), are incorporated into the system to evaluate their ability to identify network intrusions. Among the evaluated models, the Random Forest classifier achieves the highest reported accuracy of approximately 99.93%, with corresponding precision, recall, and F1-score measurements used for performance evaluation. The developed web application provides a user-friendly prediction interface where network traffic parameters can be entered for real-time intrusion classification. It also provides predefined traffic scenarios for quick demonstrations and supports administrator-based batch dataset uploading, previewing, and scoring.

A key feature of the proposed system is its Automated Threat Response and Remediation Engine. When suspicious network activity is identified, the system calculates a threat score and generates an appropriate defensive Linux `iptables` firewall policy according to the detected attack scenario. The response mechanism includes security rules for different threat categories, such as ICMP flood activity, UDP fragmentation attacks, TCP SYN flood surges, port scanning reconnaissance, and unauthorized access or guest privilege abuse. This enables the system to extend beyond intrusion detection by providing a structured security response to identified threats. The application also incorporates role-based access control with separate administrator and regular-user privileges, password hashing, performance analytics, confusion matrix visualization, precision, recall and F1-score analysis, and interactive dataset distribution charts.

The complete system is implemented as a Flask-based web application with SQLite used for account and application data management, while HTML, CSS, and JavaScript provide the interactive front-end interface. Through the integration of machine learning-based intrusion classification, real-time network traffic analysis, threat scoring, performance monitoring, and automated firewall policy generation, the proposed system provides an integrated approach to intelligent network security and automated threat response.

SYSTEM REQUIREMENTS:

HARDWARE REQUIREMENTS: 

• System : Pentium i3 Processor.
• Hard Disk : 20 GB.
• Monitor : 15’’ LED.
• Input Devices : Keyboard, Mouse.
• Ram : 8 GB.

SOFTWARE REQUIREMENTS: 

• Operating System : Windows 10 / 11.
• Coding Language : Python 3.13.15.
• Web Framework : FLASK
• Frontend : HTML, CSS, JavaScript.
• Database : SQLite.

REFERENCE:

Raeed Al-Sabri, Abdullatif Albaseer, Mohamed Abdallah, Ala Al-Fuqaha, “DMGCRL: Dynamic Multi-Scale Graph Contrastive Representation Learning For Network Intrusion Detection”, IEEE Transactions on Network and Service Management, 2026.

👉CLICK HERE TO BUY THIS PROJECT “AI-Driven Network Intrusion Detection System and Automated Threat Response Using Machine Learning” SOURCE CODE👈

FAQ’s and Answers:

What is the proposed project about?

The project “AI-Driven Network Intrusion Detection System and Automated Threat Response Using Machine Learning” is a web-based network security system that analyzes network traffic, identifies potential intrusions using machine learning models, calculates a threat score, and generates automated Linux iptables firewall responses for detected threats

What is the main objective of the project?

The main objective is to develop an integrated system for network intrusion detection and automated threat response using machine learning. The system combines traffic analysis, intrusion classification, threat scoring, and firewall rule generation within a Flask-based application.

Which dataset is used in this project?

The project uses the NSL-KDD benchmark dataset for training and evaluating the machine learning models. The project files include the NSL-KDD training dataset.

Which machine learning algorithms are used?

Three machine learning algorithms are implemented: Random Forest Classifier Decision Tree Classifier K-Nearest Neighbors (KNN) All three models are trained and evaluated using the NSL-KDD benchmark dataset.

Which machine learning model performs best?

According to the documented benchmark results, Random Forest Classifier performs best, with an accuracy of 99.93% and a documented accuracy value of 99.9312%.

What types of attacks can the system detect?

The system is designed to identify different categories of network security threats, including: Denial of Service (DoS) Port Scanning Remote-to-Local (R2L) User-to-Root (U2R) attacks.

How many network features are used for prediction?

The prediction interface focuses on 12 essential network parameters instead of requiring all 41 NSL-KDD features to be manually entered.

What happens when an attack is detected?

When an attack is detected, the Threat Remediation Engine calculates a threat score between 0 and 100 and generates a corresponding Linux iptables firewall rule based on the detected threat scenario.

What is the Threat Remediation Engine?

The Threat Remediation Engine is the component responsible for processing detected attack conditions, calculating a threat score, and generating defensive iptables firewall rules for supported attack scenarios.

Can the project be used for research publication?

Yes. The project can serve as an implementation and experimental foundation for a research paper. Contact JP INFOTECH for publishing this paper in International Journal / Conference / Scopus Journal Publication.