Network intrusion has emerged as a critical issue in the field of cybersecurity because malicious network traffic can threaten the security and reliability of modern network systems. The ability to detect such traffic and identify different attack categories can help security systems respond to potential threats and improve network monitoring. This paper presents a hybrid machine learning approach for intrusion detection that combines an Autoencoder with Random Forest classifiers to detect malicious network traffic and identify individual attack categories. The Autoencoder is trained on benign traffic to learn a compact 32-dimensional representation of the preprocessed network flow features. Further, the reconstruction error generated by the Autoencoder is evaluated as an independent anomaly signal to identify deviations from normal traffic patterns. The proposed framework is evaluated using the CICIDS2017 dataset, with 435,336 flow records retained after preprocessing. The binary classifier achieved an accuracy of 99.98%, with a precision of 99.99%, recall of 99.97%, and F1-score of 99.98%. The multiclass classifier achieved an accuracy of 99.98% and a weighted F1- score of 99.98%, with DDoS and PortScan being the most frequently identified attack categories with 25,628 and 18,106 detected samples, respectively. Moreover, the reconstruction-errorbased anomaly assessment achieved a ROC-AUC of 0.9815. The findings demonstrate the effectiveness of the proposed approach for the intrusion detection and attack-category identification, while the reconstruction error provides an additional capability for anomaly assessment. Overall, the proposed framework shows the potential of combining representation learning, supervised classification, and anomaly analysis for improving network security monitoring.

Machine learning techniques,Intrusion Detection System,deep learning,Autoencoders,Random Forest,anomaly detection,Network Security.