Passive Hybrid Network-Based Intrusion Detection System (Hybrid-NIDS) Combining Suricata and Random Forest
Suricata and Random Forest hybrid NIDS scored F1 0.97 on UNSW-NB15 but failed in lab tests.
The paper evaluates a passive hybrid NIDS that combines Suricata, Random Forest flow classification, and ELK alert handling, keeping benchmark tests separate from PCAP and live validation. After removing 1,879 conflicting-label rows from 2,540,047 UNSW-NB15 records, RF-41 reached F1 0.971 and ROC-AUC 0.9997, and an NFStream-compatible RF-21 reached F1 0.970. On a labeled laboratory PCAP, recall dropped to 0.0095, and RF-21 raised no alerts in five additional 60-second attack sessions. The authors say these results do not show that Suricata-Random Forest correlation detects better in operation than Suricata alone.
- RF-41 reached F1 0.971 and ROC-AUC 0.9997 on cleaned UNSW-NB15.
- Labeled lab PCAP recall fell to 0.0095 despite strong benchmark scores.
- RF-21 produced no alerts across five 60-second attack sessions.
- Authors say the hybrid did not beat Suricata alone operationally.
Full article204 words · extracted from arxiv.org · click to collapse
This paper evaluates a passive Hybrid Network-based Intrusion Detection System (Hybrid-NIDS) prototype that combines Suricata with Random Forest flow classification and centralized ELK-based alert handling. The study explicitly separates benchmark evaluation from PCAP/live operational validation and controls exact feature-duplicate leakage using feature hashing and group-aware splitting. From 2,540,047 UNSW-NB15 records, 453 conflicting-label hash groups containing 1,879 rows were removed; the resulting Development and Hold-out sets have zero exact feature-hash overlap. RF-41 achieved F1 = 0.971360 and ROC-AUC = 0.999671, while the NFStream-compatible RF-21 achieved F1 = 0.970148 on the same prepared hold-out boundary. However, operational validation revealed substantial benchmark-to-deployment domain shift: on a labeled laboratory PCAP, RF-21 and the strictly correlated branch achieved recall of only 0.0095, and RF-21 produced no alerts in five additional 60-second attack sessions. An unlabeled normal-traffic test produced 439 alerts from 2,375 flows; this value is reported only as an alert ratio and is not interpreted as a false-positive rate. These results show that strong performance on a public benchmark does not directly translate into operational effectiveness. Accordingly, the current Hybrid-NIDS should be interpreted as a passive prototype and evaluation framework, and the reported experiments do not demonstrate that Suricata-Random Forest correlation provides better operational detection than Suricata alone.
Text extracted automatically; images, tables and formatting may be missing. Original: https://arxiv.org/abs/2609.24393