An AI-Driven Intrusion Detection and Real-Time Autonomous Response Framework Using Network Traffic Logs: AMulti-Algorithm Approach with LightGBM Optimization

Abstract

Considering the recent technological advancement of cyber threats, the conventional intrusion detection systems (IDS), cannot support dynamic and large scale network conditions. In this paper, a hybrid intrusion detection model that integrates offline supervised learning with online adaptive learning will be described to improve the accuracy of intrusion detection and prompt response to attacks. Upon choosing the dataset by CICIDS2017, a series of machine learning models were trained and tested on them, such as the Logistic Regression, the Random Forest, the Light Gradient Boosting Machine (LightGBM) using such key performance indicators as precision, recall, and F1 score.. Also, SMOTE technology was applied to address data imbalance, resulting in significant improvements in detecting rare attack classes. Therefore, Experimental results appear to show that all models achieved a recall rate of ≥97%. The SMOTE + RF model achieved 100% accuracy with no false positives, and the LightGBM model achieved 100% full recall for all attacks. This study demonstrates the effectiveness of the proposed approach in combining high performance with self-adaptation, making it a powerful solution for modern intrusion detection systems in cybersecurity infrastructures.