A Hybrid Network Intrusion Detection System Using Convolutional Neural Network with Support Vector Machine for Imbalanced Dataset on Big Data Environment

Prediction of malicious packets plays a major role in large networks where the network traffic is very high. This work introduces a real-time packet classification application designed to identify network traffic patterns by employing deep learning and machine learning techniques. The application is designed using Python libraries such as Scapy for packet capturing and analysis, TensorFlow and Scikit-learn for model development, and Tkinter for the graphical user interface. The application enables users to specify a timeout period for packet sniffing while monitoring the network traffic. The captured packets are preprocessed and fed to a modular combination of Convolutional Neural Networks (CNN) and Support Vector Machines (SVM). The CNN model categorizes packets into one of three classes: normal, suspicious, or unknown and the SVM provides numerical labels. The real-time classification results, including source and destination IP addresses along with the predictions, are displayed in the Graphical User Interface (GUI). Further, the application provides flexibility for further processing or customization of display based on user preferences. The CIDDDS-001 dataset is used to train these models. This empowers network administrators to promptly identify potentially malicious or anomalous network behaviour and aids in threat detection efforts.