A Hybrid Machine-Learning Framework for Intrusion Detection: Comparative Evaluation and Statistical Validation

The increasing sophistication and frequency of cyberattacks have intensified the need for Intrusion Detection Systems (IDS) that are both accurate and adaptive. Traditional IDS, whether signature-based or anomaly-based, provides foundational protection but faces well-documented limitations: signature-based systems struggle against zero-day exploits, while anomaly-based systems often produce high false positive rates. To address these challenges, researchers and practitioners are increasingly turning to Machine Learning (ML) as a means of enhancing IDS capabilities. This paper explores the integration of ML techniques—supervised, unsupervised, and deep learning—into IDS frameworks and evaluates their effectiveness using widely recognized datasets, including NSL-KDD and CICIDS2017. Supervised learning methods such as Random Forest and Support Vector Machines (SVM) demonstrate strong classification abilities, while unsupervised clustering approaches offer promise in identifying novel attacks. Deep learning models, particularly Recurrent Neural Networks (RNNs), show state-of-the-art performance in capturing sequential traffic patterns and detecting subtle anomalies. In addition to model comparisons, this study emphasizes the practical relevance of ML-enhanced IDS by examining its integration with established tools like Snort and Zeek. Our results highlight that ML-driven IDS consistently outperforms traditional approaches, with RNNs and Random Forest achieving the highest balance of accuracy and efficiency. The findings underscore the potential of ML-based IDS to serve as the next frontier in cybersecurity, offering improved detection accuracy, reduced false alarms, and adaptability to evolving threats. At the same time, challenges remain in terms of dataset representativeness, computational demands, and the interpretability of deep learning models. By situating the analysis within both academic research and real-world deployment contexts, this paper contributes to a clearer understanding of the opportunities and trade-offs in advancing IDS through machine learning.