A Hybrid Network Intrusion Detection Framework Using Association Mining and Ensemble Learning

Abstract

The rapid growth of internet traffic has made computer networks vulnerable to intrusions, and a major challenge to protect them against such intrusions. Signature-based Intrusion Detection Systems (IDS) work well for known attacks but are incapable of detecting new or changing attacks. This study suggests a hybrid Network Intrusion Detection System (NIDS) that integrates association mining with a Random Forest classifier for both accuracy and explainability. Network traffic data from benchmark datasets (NSL-KDD, CIC-IDS2017, and UNSW-NB15) in the suggested framework goes through preprocessing, discretization, and conversion into transactions of feature-value pairs. An Apriori algorithm based on hashing is used to systematically mine frequent itemsets and produce high-confidence association rules connecting feature patterns with class labels (attack or normal). The rules are subsequently represented as binary features and combined with the initial feature space to augment the input to the classifier. A Random Forest model is trained on this hybrid feature representation, taking both the raw features and rule-based knowledge into account. Experimental results demonstrate that the proposed system outperforms existing approaches, achieving a peak accuracy of 98.9% and an ROC-AUC score of 0.98 on the NSL-KDD dataset. Incorporating rule-based features enhances not only the detection rate but also the system's interpretability, offering clear, human-readable patterns that explain the triggers for alerts. The hybrid system is therefore scalable, real-time, and transparent and thus a practical solution for modern network security scenarios.