An Intelligent Hybrid Intrusion Detection System Based on Random Forest Feature Selection and Isolation Forest Anomaly Detection

الملخص

The rapid expansion of network infrastructure has made cybersecurity a critical concern in modern digital environments. Intrusion Detection Systems (IDS) play a vital role in identifying malicious network activities; however, traditional signature-based approaches often fail to detect novel or sophisticated attacks. This paper presents an intelligent hybrid IDS that combines supervised and unsupervised machine learning techniques to improve detection accuracy and generalizability. The proposed system is evaluated on the CICIDS2017 dataset, which contains labeled traffic records representing both benign and multiple attack categories. The preprocessing pipeline involves removing missing values, eliminating infinite values, and applying binary label encoding with MinMax normalization. SMOTE is applied exclusively to the training set to address severe class imbalance. Feature selection is performed using Random Forest Gini impurity importance, retaining the top 30 most discriminative features from an original 78. The hybrid detection model integrates an Isolation Forest for anomaly detection with a Random Forest classifier for supervised classification, combined through a logical OR voting mechanism. The system is validated using 5-Fold Cross Validation, achieving a mean accuracy of 95.5%, precision of 91.8%, recall of 99.9%, and F1-score of 95.7%, demonstrating superior attack detection over individual model approaches.