Real-Time AI-Powered Intrusion Detection and Prevention System (IDPS): A Practical Implementation Using Machine Learning
摘要
With the growth in the sophistication and prevalence of cyber threats, there is a need for sophisticated mechanisms to ensure the security of digital infrastructure. This paper describes a real-time Artificial Intelligence (AI) based Intrusion Detection and Prevention System (IDPS) that can be used to identify and classify intrusions with high accuracy. The proposed system uses machine learning algorithms and the KDD cup 1999 data set to carry out both binary (normal vs. attack) and multiclass classification (attack type identification) on real-time data. We describe the entire pipeline from data preprocessing, model training, and evaluation, to invading malicious traffic in real time and classification. Our system is a combination of efficiency, scalability, and high accuracy detection, which provides a basis for further improvement of intelligent cybersecurity solutions. Key contributions include (i) a fully reproducible scikit-learn pipeline persisted with Joblib, (ii) a lightweight predictor service that classifies flows in [in ca. 8 ms end-to-end], (iii) a network-driver compatibility workflow for Windows hosts and (iv) a set of field lessons that reduce time-to-deployment for future researchers.