Design and Evaluation of a Supervised Machine Learning-Based Intrusion Detection System.

This project involves designing and evaluating a supervised machine-learning-based intrusion detection system (IDS) using the CIC-IDS2017 dataset.The project is structured around the cross-industry standard process for data mining (CRISP-DM) framework.The dataset comprises over 2.8 million labelled instances and was cleaned and reduced from 78 to 63 features via redundancy analysis.These data were used to train and tune three supervised classifiers: Logistic Regression algorithm as a linear baseline, a Decision Tree algorithm and a Random Forest algorithm.Hyperparameter optimisation was conducted using RandomizedSearchCV with 3-fold cross-validation, optimising for the F1-macro scoring metric.While the random forest performed similarly on majority classes, the final decision tree model generalised significantly better on rare attacks such as Heartbleed and Infiltration.On the test set, the decision tree achieved a macro-F1 score of 0.96 and an accuracy score of 99.88%, with a minimal train/test gap of 0.0008.To evaluate its real-world viability, the model was deployed via a live capture test using Nmap, Wireshark and CICFlowMeter, alongside a cross-dataset evaluation on CIC-IDS2018.The final results highlighted the inherent challenges of cross-dataset generalisation: while the model maintained high precision, it exhibited reduced recall on unseen data.