Implementation of a Network Security System using an Intrusion Prevention System with Machine Learning

Abstract

This research develops a machine learning-based Intrusion Prevention System (IPS) to automatically detect and prevent network attacks. The system was designed using the Random Forest algorithm, trained on the CICIDS2017 and CICIDS2019 datasets—standard benchmarks developed by the Canadian Institute for Cybersecurity, widely used in cybersecurity research for their realistic network traffic and diverse attack types. The system focuses on three common attacks: SYN Flood, Port Scanning, and SSH Patator. After preprocessing, training, and evaluation, the model was integrated into the IPS, enabling real-time network monitoring, attacker IP blocking, and automated notifications via Telegram. Testing results indicate that the system achieves high detection accuracy while delivering fast and efficient responses. This system simplifies the work of network administrators by detecting and responding to attacks without the need for manual log monitoring. Through its automated and adaptive approach, the IPS makes a significant contribution to enhancing network security and can be directly implemented in organizational or institutional network environments to substantially reduce the risk of cyberattacks.