[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"doc-seo-291091-105":3,"detail-sidebar-cat-0-en-105":81,"doc-detail-291091-en":131},{"code":4,"msg":5,"data":6},0,"ok",{"site_id":7,"language":8,"slug":9,"title":10,"keywords":11,"description":12,"schema_data":13,"social_meta":74,"head_meta":76,"extra_data":78,"updated_unix":80},105,"en","a-multi-class-classification-of-intrusion-detection-system-based-on-machine-learning","A Multi-Class Classification of Intrusion Detection System based on machine learning","","Intrusion Detection Systems (IDSs) serve as a first line of defense in organizational network security by identifying potential intrusions and mitigating cyber threats that can disrupt websites and servers. The study proposes a LightGBM-based flow anomaly detection model for multi-class intrusion detection using the CICIDS2017 datasets, addressing multi-attack classification performance. Evaluation reports 0.9984 accuracy with F1-score 0.9591 and precision 0.9356, with strong detection and low false alarms, improving dynamic capability by blending CICIDS2017 data with SMOTE.",{"@graph":14,"@context":73},[15,34,56],{"@type":16,"itemListElement":17},"BreadcrumbList",[18,23,27,31],{"item":19,"name":20,"@type":21,"position":22},"https://docshare.wps.com","Home","ListItem",1,{"item":24,"name":25,"@type":21,"position":26},"https://docshare.wps.com/document/","Document",2,{"item":28,"name":29,"@type":21,"position":30},"https://docshare.wps.com/document/research-report/","Research & Report",3,{"item":32,"name":10,"@type":21,"position":33},"https://docshare.wps.com/document/a-multi-class-classification-of-intrusion-detection-system-based-on-machine-learning/291091/",4,{"url":32,"name":10,"@type":35,"image":36,"author":41,"headline":10,"publisher":44,"fileFormat":47,"inLanguage":8,"description":12,"dateModified":48,"datePublished":49,"encodingFormat":47,"isAccessibleForFree":50,"interactionStatistic":51},"DigitalDocument",{"url":37,"@type":38,"width":39,"height":40},"https://docshare.wps.com/thumbnails/a-multi-class-classification-of-intrusion-detection-system-based-on-machine-learning/291091.png","ImageObject",300,407,{"name":42,"@type":43},"Theodora","Person",{"url":19,"name":45,"@type":46},"DocShare","Organization","application/pdf","2026-11-09","2026-09-17",true,{"@type":52,"interactionType":53,"userInteractionCount":55},"InteractionCounter",{"@type":54},"ViewAction",16,{"@type":57,"mainEntity":58},"FAQPage",[59,65,69],{"name":60,"@type":61,"acceptedAnswer":62},"What problem does the paper address in intrusion detection?","Question",{"text":63,"@type":64},"It focuses on improving multi-class intrusion detection effectiveness and overcoming limitations when classification is performed on imbalanced datasets without adequate dynamic detection mechanisms.","Answer",{"name":66,"@type":61,"acceptedAnswer":67},"What model and dataset are used to build the proposed IDS?",{"text":68,"@type":64},"The approach uses a LightGBM-based model and evaluates it with the CICIDS2017 dataset for multi-attack classification.",{"name":70,"@type":61,"acceptedAnswer":71},"How does SMOTE contribute to the system’s performance?",{"text":72,"@type":64},"SMOTE is used to address class imbalance by generating synthetic samples for minority classes, helping train a more balanced model and improve detection performance.","https://schema.org",{"og:url":32,"og:type":75,"og:title":10,"og:site_name":45,"og:description":12},"article",{"robots":77,"canonical":32},"index,follow",{"doc_id":79,"site_id":7},291091,1789643428,{"code":4,"msg":82,"data":83},"success",[84,88,92,96,101,106,111,115,120,123,127],{"id":22,"doc_module":4,"doc_module_name":25,"category_name":85,"show_sort_weight":86,"slug":87},"Story & Novel",90,"story-novel",{"id":26,"doc_module":4,"doc_module_name":25,"category_name":89,"show_sort_weight":90,"slug":91},"Literature",80,"literature",{"id":33,"doc_module":4,"doc_module_name":25,"category_name":93,"show_sort_weight":94,"slug":95},"Exam",70,"exam",{"id":97,"doc_module":4,"doc_module_name":25,"category_name":98,"show_sort_weight":99,"slug":100},5,"Comic",60,"comic",{"id":102,"doc_module":4,"doc_module_name":25,"category_name":103,"show_sort_weight":104,"slug":105},6,"Technology",50,"technology",{"id":107,"doc_module":4,"doc_module_name":25,"category_name":108,"show_sort_weight":109,"slug":110},7,"Healthcare",40,"healthcare",{"id":112,"doc_module":4,"doc_module_name":25,"category_name":29,"show_sort_weight":113,"slug":114},8,30,"research-report",{"id":116,"doc_module":4,"doc_module_name":25,"category_name":117,"show_sort_weight":118,"slug":119},9,"Religion & Spirituality",20,"religion-spirituality",{"id":118,"doc_module":4,"doc_module_name":25,"category_name":121,"show_sort_weight":118,"slug":122},"World Cup","world-cup",{"id":124,"doc_module":4,"doc_module_name":25,"category_name":125,"show_sort_weight":124,"slug":126},10,"Lifestyle","lifestyle",{"id":128,"doc_module":4,"doc_module_name":25,"category_name":129,"show_sort_weight":97,"slug":130},19,"General","general",{"code":4,"msg":82,"data":132},{"doc_id":79,"user_id":133,"nickname":42,"user_avatar":134,"doc_module":4,"category_id":112,"category_name":29,"doc_title":10,"doc_description":12,"doc_content":135,"file_id":136,"file_url":137,"file_type":138,"file_size":139,"view_count":55,"is_deleted":4,"is_public":22,"is_downloadable":22,"audit_status":22,"page_count":140,"language":141,"language_code":8,"site_id":7,"html_lang":8,"table_of_contents":142,"faqs":143,"seo_title":144,"seo_description":12,"update_tm":80,"read_time":113,"preview_page_count":4},687197207919,"https://ap-avatar.wpscdn.com/avatar/a000253d6f5f7c60be?x-image-process=image/resize,m_fixed,w_180,h_180&k=1779446848396160552","Research Article  \nA Multi-Class Classification of Intrusion Detection System  \nbased on machine learning  \nWasan Mueti Hadi  \nDepartment of Computer Science, College of Computer Science and Information Technology, University ofKerbala, Iraq.  \n\n| \u003Cbr>Article Info\u003Cbr>Article history: Received 1-12-2025 Received in revised form 29-12-2025 Accepted 29-1-2026 Available online 31-3 -2026\u003Cbr>Keywords:\u003Cbr>Intrusion Detection System, Machine Learning, LightGBM, CICIDS2017_SMOTE | Abstract\u003Cbr>Intrusion Detection Systems (IDSs) are representing a core of component of organizational network security, as they serve as the first line of defence against a wide range of cyber threats. They are responsible for effectively handling potential intrusions on the network. Internet attacks severely damage a website or server, make them inaccessible to other users. Numerous IDS systems employ flow-based network traffic analysis to identify potential threats. In this paper, we proposed a LightGBM(Light Gradient Boosting Machine) machine learning model that designed to create a flowbased anomaly detection intrusion detection system for multi-class classification. The model is evaluated using the updated CICIDS2017 dataset) CICIDS2017_Cleaned( for multi-attack classification. The model achieved an accuracy of 0.9984,F1-score of 0.9591and precision of 0.9356. The model has excelled in accuracy, detection rate, and low false alarm rate.Because they often use machine learning techniques for rather than intrusion detection systems. The study shows that the results are difficult with multi-class classification on imbalanced data sets, and lacks effective dynamic detection mechanism. In order to remedy this research gap, this article proposes a lightGBM-based dynamic intrusion detection system blending the CICIDS2017 dataset with SMOTE. |\n| --- | --- |\n\nCorresponding Author [E-mail:](E-mail: wasan.m@uokerbala.edu.iq)[ wasan.m@uokerbala.edu.iq](E-mail: wasan.m@uokerbala.edu.iq)  \nPeer review under responsibility of Iraqi Academic Scientific Journal and University of Kerbala.  \nIntroduction  \nIn recent years, the increasing vulnerability of numerous organizations to advanced cyber-attacks has prompted a rapid development of novel Intrusion Detection Systems (IDSs) . The advancement of Intrusion Detection Systems (IDSs) is of interest to both the academic and industrial sectors globally, owing to the repercussions of each cyberattack, including economic costs, reputational harm, and legal issues. Consequently, it is imperative to safeguard networks against unwanted access and to protect user communications and data, as well as to identify emerging security vulnerabilities [1] . Intrusion Detection Systems (IDS) are critical to enhancing corporate security. They provide an additional layer, which is that of defence detecting there and readiness to respond quickly to any threat escaped by preventive measures. Threats identified by this system may include malware and phishing attacks, as well as innumerable types of cyber assaults outside the scope fixed on regular security solutions[2] . The IDS takes PrimeProbe potential failures identified as emerged through a network layer, and identificates them as anomalies.This method is typically static and linked to the rules or algorithms utilized for detecting cyberattacks. However, this static methodology presents  \ndifficulties in adapting the recognition of new attack types, since it requires the modification of rules for signature-based IDS or the retraining of the detection model for anomaly-based IDS. Anomalybased Intrusion Detection Systems (IDS) are closely linked to the application of machine learning (ML) techniques[3] . We deployed an intrusion detection system using the CICIDS2017 dataset, employing the Synthetic Minority Over-sampling Technique (SMOTE).This technique in machine learning is utilized to address class imbalance issues in datasets. SMOTE produces synthetic samples for the minority class by ama","cbCaiiX2CAqsuRiF","https://ap.wps.com/l/cbCaiiX2CAqsuRiF","pdf",1236285,12,"English","# Introduction\n## Related Work\n## Representation and Generalization","[{\"question\":\"What problem does the paper address in intrusion detection?\",\"answer\":\"It focuses on improving multi-class intrusion detection effectiveness and overcoming limitations when classification is performed on imbalanced datasets without adequate dynamic detection mechanisms.\"},{\"question\":\"What model and dataset are used to build the proposed IDS?\",\"answer\":\"The approach uses a LightGBM-based model and evaluates it with the CICIDS2017 dataset for multi-attack classification.\"},{\"question\":\"How does SMOTE contribute to the system’s performance?\",\"answer\":\"SMOTE is used to address class imbalance by generating synthetic samples for minority classes, helping train a more balanced model and improve detection performance.\"}]","A Multi-Class Classification of Intrusion Detection System based on machine learning | PDF"]