Hybrid Intrusion Detection System Using Random Forest and Support Vector Machine Techniques

Abstract

Intrusion Detection Systems (IDSs) play a critical role in protecting modern networks against increasingly sophisticated cyberattacks. However, traditional IDS approaches often suffer from limitations such as low detection accuracy, high false alarm rates, and poor efficiency when processing large-scale network traffic. To address these challenges, this study proposes a hybrid intrusion detection model that combines Random Forest (RF) and Support Vector Machine (SVM) algorithms to improve detection performance and reliability. The motivation for integrating RF and SVM lies in their complementary strengths: Random Forest provides robustness against overfitting and effective handling of high-dimensional data, while SVM offers strong classification capability for complex and non-linear attack patterns. The proposed hybrid RF–SVM model was evaluated using the CIC-IDS2017 dataset, which contains realistic labeled network traffic representing both normal activities and multiple cyberattack categories, including DDoS, brute force, infiltration, botnets, web attacks, and port scanning. Experimental results demonstrate that the proposed hybrid model achieved an accuracy of 94%, precision of 93%, recall of 94%, and F1-score of 94%, outperforming standalone RF and SVM models in intrusion detection performance. Although the false positive rate slightly increased, the proposed approach significantly improved detection sensitivity and reduced the likelihood of missed attacks. The findings indicate that the RF–SVM hybrid model provides an effective and scalable solution for real-time intrusion detection in modern cybersecurity environments.