Machine Learning-Based Network Intrusion Detection for Secure Communication Systems

Abstract

Secure communication systems require timely recognition of malicious network behavior without overwhelming security analysts with false alarms. This methodology paper presents a machine learning-based network intrusion detection framework that converts packet- or flow-level traffic into a supervised binary decision between normal and attack activity. The proposed workflow combines data cleaning, categorical encoding, normalization, feature selection, stratified training and testing, and comparative classification using Random Forest (RF), Support Vector Machine (SVM), Decision Tree (DT), and Logistic Regression (LR). NSL-KDD is selected as a reproducible baseline because it reduces major redundancy problems of KDD Cup 99, while CICIDS2017 is recommended as a secondary modern validation dataset containing diverse benign and attack traffic. Performance is evaluated using accuracy, precision, recall/detection rate, F1-score, false-positive rate, confusion matrices, and inference time. Rather than claiming unperformed experiments, the results section defines literature-grounded benchmark expectations and decision rules for selecting the final model. The methodology emphasizes reproducibility, class-imbalance awareness, cross-dataset validation, and operational relevance for secure communication environments.