ADAPTIVE DECISION-MAKING MODEL FOR HYBRID INTRUSION DETECTION SYSTEMS

Abstract

The increasing complexity of cyber threats, together with the limitations of traditional intrusion detection systems based exclusively on signature analysis or probabilistic machine learning models, creates a need for comprehensive adaptive decision-making models. Although machine learning methods can provide high sensitivity to anomalies in network traffic, their application may be associated with false positives and insufficient interpretability of the obtained results. An additional challenge is the coordinated fusion of heterogeneous security indicators that differ in nature, reliability, and criticality, including cryptographic indicators, temporal and behavioral characteristics, and historical risk estimates.

This paper proposes an adaptive decision-making model for a hybrid intrusion detection system that combines heterogeneous security features within a unified risk assessment mechanism. The first level of the model is based on deterministic cryptographic control, which provides prioritized detection of critical violations. When a critical cryptographic violation is detected, the system generates an intrusion decision independently of the results produced by the other components. In the absence of such a violation, adaptive weighted fusion of the normalized cryptographic score, the probabilistic estimate produced by a Random Forest-based machine learning module, and the accumulated historical risk is performed, followed by threshold-based formation of the final decision.

A software prototype was developed and a series of experimental studies was conducted in a distributed environment using a dataset of 1,099 test sessions covering normal, suspicious, intrusion, combined, and previously unseen scenarios. The experimental results showed that the integrated model achieved a macro-averaged area under the ROC curve of Macro AUC = 0.963 and an overall classification accuracy of 88.81%, while Macro Precision, Macro Recall, and Macro F1-score reached 0.89, 0.88, and 0.88, respectively. None of the intrusion scenarios was classified as a normal state.

The proposed model extends the capabilities of traditional intrusion detection systems by combining deterministic cryptographic control with adaptive risk assessment based on machine learning and node behavior history. This approach makes it possible to account for both critical integrity violations and weak accumulated anomalies, which indicates the potential applicability of the proposed model in distributed information and communication systems and cyber-physical systems with increased security requirements.