Passive Hybrid Network-Based Intrusion Detection System (Hybrid-NIDS) Combining Suricata and Random Forest
Suricata and Random Forest hybrid NIDS scored F1 0.97 on UNSW-NB15 but failed in lab tests.
The paper evaluates a passive hybrid NIDS that combines Suricata, Random Forest flow classification, and ELK alert handling, keeping benchmark tests separate from PCAP and live validation. After removing 1,879 conflicting-label rows from 2,540,047 UNSW-NB15 records, RF-41 reached F1 0.971 and ROC-AUC 0.9997, and an NFStream-compatible RF-21 reached F1 0.970. On a labeled laboratory PCAP, recall dropped to 0.0095, and RF-21 raised no alerts in five additional 60-second attack sessions. The authors say these results do not show that Suricata-Random Forest correlation detects better in operation than Suricata alone.
- RF-41 reached F1 0.971 and ROC-AUC 0.9997 on cleaned UNSW-NB15.
- Labeled lab PCAP recall fell to 0.0095 despite strong benchmark scores.
- RF-21 produced no alerts across five 60-second attack sessions.
- Authors say the hybrid did not beat Suricata alone operationally.
From the original article
1 min read at arxiv.orgThis paper evaluates a passive Hybrid Network-based Intrusion Detection System (Hybrid-NIDS) prototype that combines Suricata with Random Forest flow classification and centralized ELK-based alert handling. The study explicitly separates benchmark evaluation from PCAP/live operational validation and controls exact feature-duplicate leakage using feature hashing and group-aware splitting.
By Quoc-Cuong Tang · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.