Enhanced Intrusion Detection System Using Hybrid Data Mining Techniques

Abstract

Network intrusion detection remains a core cybersecurity function because signature-only systems are weak against previously unseen attacks, while single machine-learning classifiers may be sensitive to irrelevant features, imbalanced classes, and heterogeneous attack behavior. This methodology paper proposes an enhanced intrusion detection system (E-IDS) that integrates complementary data-mining techniques in a staged hybrid architecture. The method combines data cleaning and class balancing, decision-tree-based recursive feature elimination, Local Outlier Factor (LOF) anomaly screening, and a supervised Random Forest–Support Vector Machine (RF–SVM) classification layer. A decision-fusion stage consolidates anomaly and classifier scores to generate final alerts. The proposed evaluation uses benchmark network datasets such as CICIDS2017 or UNSW-NB15, stratified training/testing, cross-validation, and standard measures including accuracy, precision, recall, F1-score, detection rate, and false-alarm rate. The design is motivated by evidence that hybrid feature selection, anomaly filtering, ensemble learning, and deep or combined classifiers improve network intrusion detection compared with isolated models. The paper presents a reproducible experimental protocol and literature-grounded performance expectations rather than claiming unexecuted measurements. The framework is intended to improve attack coverage, reduce false positives, and support scalable network security monitoring.