Submit your papersSubmit Now
For Enquiries: [email protected]
IIARD LogoIIARD

Enhanced Machine Learning-Based Intrusion Detection System for Zero-Day Attacks

UE-Bee, Kakuubari Promise, Sako, D.J.S, Nwiabu, N. D

Abstract

The recent rise in complex cyber-attacks has led to the need for intrusion detection systems that can detect both known and previously unseen attacks in network traffic with minimal false positives. This paper presents Enhanced Machine Learning Based Intrusion Detection System for Zero-Day Network Attacks as a solution to the problem of zero-day attack detection with minimal false positives. The proposed model uses a hybrid detection architecture that comprises of Signature-Based Detection, Random Forest classifier, Confidence Gate, and MiniBatch K-Means clustering to detect both known and zero-day attacks respectively. The intrusion detection system was designed and implemented using Python and CICIDS2017 dataset was used for training and evaluating the proposed models. The experimental results showed that Random Forest attained an accuracy of 99.59 % with a precision of 99.58%, a recall of 99.59%, and an F1-score of 99.58%. On the other hand, MiniBatch K-Means attained a Silhouette Score of 0.8989%. This demonstrated that that signature-based detection rules coupled with supervised and unsupervised machine learning algorithms could effectively detect known attacks and suspicious activities. The prototype was able to monitor live network traffic and present dashboards with visualizations of security- related events.

Keywords

Intrusion detection systemzero-day attackRandom ForestMiniBatch K-Meanshybrid detectionSecurity Operations Center; MITRE ATT&CK

References

Abdelaziz, M. T., et al. (2025). Enhancing network threat detection with Random Forest for network intrusion detection systems. Journal of Network and Systems Management. Ahmad, Z., Khan, A. S., Shiang, C. W., Abdullah, J., & Ahmad, F. (2021). Network intrusion detection system: A systematic study of machine learning and deep learning approaches. Transactions on Emerging Telecommunications Technologies, 32(1), e4150. Ahmed, N., et al. (2025). Hybrid model for novel attack detection using a cluster-based classification approach. Future Internet, 17(6), 251. Ahmed, U., et al. (2025). Signature-based intrusion detection using machine learning and deep learning techniques. Scientific Reports. Aldweesh, A., Derhab, A., & Emam, A. Z. (2020). Deep learning approaches for anomaly-based intrusion detection systems: A survey, taxonomy, and open issues. Knowledge-Based Systems, 189, 105124. Ali, T. E., Chong, Y. W., & Manickam, S. (2023). Comparison of machine learning and deep learning approaches for detecting DDoS attacks in software-defined networking. Applied Sciences, 13(5), 3033. Alkasassbeh, M., & Al-Haj Baddar, S. (2023). Intrusion detection systems: A state-of-the-art taxonomy and survey. Arabian Journal for Science and Engineering, 48(8), 10021–10064. Almuhanna, R., & Dardouri, S. (2025). A deep learning/machine learning approach for anomaly- based network intrusion detection. Frontiers in Artificial Intelligence, 8, 1625891. Alsubaei, F., Abuhussein, A., & Shiva, S. (2022). A survey of intrusion detection systems in the Internet of Things. Journal of Network and Computer Applications, 198, 103294. Alzubaidi, L., Zhang, J., Humaidi, A. J., Al-Dujaili, A., Duan, Y., Al-Shamma, O., et al. (2021). Review of deep learning: Concepts, CNN architectures, challenges, applications, future directions. Journal of Big Data, 8, 53. Arreche, O., Abdallah, M., & Guntur, T. (2024). XAI-IDS: Toward an explainable artificial intelligence framework for enhancing network intrusion detection systems. Applied Sciences, 14(10), 4170. Arreche, O., Bibers, I., & Abdallah, M. (2024). A two-level ensemble learning framework for enhancing network intrusion detection systems. IEEE Access. Belavagi, M. C., & Muniyal, B. (2016). Performance evaluation of supervised machine learning algorithms for intrusion detection. Procedia Computer Science, 89, 117–123. Breiman, L. (2001). Random forests. Machine Learning, 45(1), 5–32. Buczak, A. L., & Guven, E. (2016). A survey of data mining and machine learning methods for cyber security intrusion detection. IEEE Communications Surveys & Tutorials, 18(2), 1153–1176. Dai, Z., Por, L. Y., Chen, Y.-L., Yang, J., Ku, C. S., Alizadehsani, R., Pławiak, P., & Acharya, U. R. (2024). An intrusion detection model to detect zero-day attacks in unseen data using machine learning. PLOS ONE, 19(9), e0308469. Danso, P. K., Neto, E. C. P., Dadkhah, S., Zohourian, A., Molyneaux, H., & Ghorbani, A. A.(2022). Ensemble-based intrusion detection for Internet of Things devices. In Proceedings of the IEEE HONET Conference (pp. 34–39). Denning, D. E. (1987). An intrusion-detection model. IEEE Transactions on Software Engineering, 13(2), 222–232. IJCSMT Ferrag, M. A., Maglaras, L., Moschoyiannis, S., & Janicke, H. (2023). Deep learning for cyber security intrusion detection: Approaches, datasets, and future research directions. Computer Networks, 225, 109653. Gu, J., & Lu, S. (2021). An effective intrusion detection approach using support vector machine with Naïve Bayes feature embedding. Computers & Security, 103, 102158.

More Articles from INTERNATIONAL JOURNAL OF COMPUTER SCIENCE AND MATHEMATICAL THEORY