Machine Learning Based Intrusion Detection Research Articles

Machine Learning-Based Methodologies for Cyber-Attacks and Network Traffic Monitoring: A Review and Insights

The number of connected IoT devices is increasing significantly due to their many benefits, including automation, improved efficiency and quality of life, and reducing waste. However, these devices have several vulnerabilities that have led to the rapid growth in the number of attacks. Therefore, several machine learning-based intrusion detection system (IDS) tools have been developed to detect intrusions and suspicious activity to and from a host (HIDS—Host IDS) or, in general, within the traffic of a network (NIDS—Network IDS). The proposed work performs a comparative analysis and an ablative study among recent machine learning-based NIDSs to develop a benchmark of the different proposed strategies. The proposed work compares both shallow learning algorithms, such as decision trees, random forests, Naïve Bayes, logistic regression, XGBoost, and support vector machines, and deep learning algorithms, such as DNNs, CNNs, and LSTM, whose approach is relatively new in the literature. Also, the ensembles are tested. The algorithms are evaluated on the KDD-99, NSL-KDD, UNSW-NB15, IoT-23, and UNB-CIC IoT 2023 datasets. The results show that the NIDS tools based on deep learning approaches achieve better performance in detecting network anomalies than shallow learning approaches, and ensembles outperform all the other models.

A Detailed Inspection of Machine Learning Based Intrusion Detection Systems for Software Defined Networks

The growing use of the Internet of Things (IoT) across a vast number of sectors in our daily life noticeably exposes IoT internet-connected devices, which generate, share, and store sensitive data, to a wide range of cyber threats. Software Defined Networks (SDNs) can play a significant role in enhancing the security of IoT networks against any potential attacks. The goal of the SDN approach to network administration is to enhance network performance and monitoring. This is achieved by allowing more dynamic and programmatically efficient network configuration; hence, simplifying networks through centralized management and control. There are many difficulties for manufacturers to manage the risks associated with evolving technology as the technology itself introduces a variety of vulnerabilities and dangers. Therefore, Intrusion Detection Systems (IDSs) are an essential component for keeping tabs on suspicious behaviors. While IDSs can be implemented with more simplicity due to the centralized view of an SDN, the effectiveness of modern detection methods, which are mainly based on machine learning (ML) or deep learning (DL), is dependent on the quality of the data used in their modeling. Anomaly-based detection systems employed in SDNs have a hard time getting started due to the lack of publicly available data, especially on the data layer. The large majority of existing literature relies on data from conventional networks. This study aims to generate multiple types of Distributed Denial of Service (DDoS) and Denial of Service (DoS) attacks over the data plane (Southbound) portion of an SDN implementation. The cutting-edge virtualization technology is used to simulate a real-world environment of Docker Orchestration as a distributed system. The collected dataset contains examples of both benign and suspicious forms of attacks on the data plane of an SDN infrastructure. We also conduct an experimental evaluation of our collected dataset with well-known machine learning-based techniques and statistical measures to prove their usefulness. Both resources we build in this work (the dataset we create and the baseline models we train on it) can be useful for researchers and practitioners working on improving the security of IoT networks by using SDN technologies.

Optimizing Machine Learning-Based Intrusion Detection Systems for Enhanced Security in Cloud Computing Environments.

In today’s cloud computing environments, robust network security is crucial due to the inherently distributed and dynamic nature of cloud systems. Traditional Network Intrusion Detection Systems (NIDS) often face challenges in handling large-scale, rapidly evolving data and sophisticated attack vectors unique to cloud settings. This paper presents an optimized Machine Learning (ML)-based NIDS framework designed specifically for cloud infrastructures, leveraging feature selection, dimensionality reduction, and algorithmic tuning techniques to enhance detection accuracy and reduce false positives. Integrating supervised and unsupervised learning methods, this NIDS system can detect both known and novel attack types efficiently. By utilizing cloud-specific datasets and real-time traffic monitoring, it adapts well to the scalability and elasticity requirements of cloud environments. Additionally, the system incorporates automated optimization techniques, such as hyperparameter tuning and ensemble learning, to further enhance performance. Experimental results show improvements in detection rates, reduced computational overhead, and better scalability, making it a promising solution for modern cloud-based infrastructures.

XAIEnsembleTL-IoV: A new eXplainable Artificial Intelligence ensemble transfer learning for zero-day botnet attack detection in the Internet of Vehicles

The Internet of Vehicles (IoV) is a network of interconnected vehicles that use modern communication technologies to communicate with each other and the surrounding infrastructure. The IoV is a novel network that experiences a continuous emergence and evolution of various forms of attacks. This research addresses the growing challenge of detecting zero-day botnet attacks within the IoV, a complex network that enhances real-time communication among vehicles and surrounding infrastructure to improve traffic management, safety, and driving experiences. Traditional machine learning-based intrusion detection systems (IDS) for IoV face two key limitations: the requirement for large labeled datasets and the “black box” issue, where the reasoning behind model decisions is not transparent, reducing user and stakeholder confidence. To solve these problems, this research proposes an eXplainable Artificial Intelligence (XAI) Ensemble Transfer Learning (TL) model specifically for detecting zero-day attacks in IoV. The proposed model integrates deep Shapley Additive Explanations (SHAP), providing transparency and making decisions understandable to cybersecurity professionals. Additionally, the model employs hybrid bidirectional long-short-term memory with autoencoders (BiLAE) to reduce the dimensionality of IoV network traffic, improving computational efficiency. It also uses Barnacle Mating Optimizer (BMO) to optimize the hyper-parameters of deep learning models such as ResNet, Inception, Inception ResNet, and MobileNet Convolution neural network-transfer learning architecture (CNN-TL), enhancing detection capabilities without needing vast amounts of labeled data. Experimental results showed that the model performed with an accuracy of 100 %, precision of 100 %, recall of 100 %, F1-score of 100 %, and Matthew Correlation Coefficient of 100 % in binary-class situations for internal vehicular (CAN) networks and achieved 99.88 % accuracy and similarly high metrics in multi-class scenarios for external vehicular networks(N-BaIoT). Compared to state-of-the-art techniques, the model proved to be more effective in detecting zero-day botnet attacks, reducing reliance on large datasets. Unlike traditional black-box models, the XAI component of the ensemble model offers insight into the decision-making process. It allows network administrators and security experts to understand how specific patterns in the data contribute to detection, making the system more transparent. The solution is highly adaptable and scalable for real-time application, designed to operate efficiently even on IoV gateway electronic control units with limited computational power.

Semi-supervised intrusion detection system for in-vehicle networks based on variational autoencoder and adversarial reinforcement learning

Despite the affordability, simplicity, and efficiency of controller area network (CAN) protocols, the security vulnerability remains a major challenge. Currently, a machine learning-based intrusion detection system (IDS) is considered an effective approach for improving security in CAN by identifying malicious attacks. However, earlier studies that relied on supervised learning methods required considerable amounts of labeled data. Data collection from vehicles is time-consuming and expensive. Furthermore, the obtained data exhibited a class imbalance, which presents further challenges in the analysis and model training. Thus, we propose a semi-supervised learning-based IDS that combines variational autoencoder (VAE) and adversarial reinforcement learning for the multi-class classification of both known and unknown attacks. The proposed system capitalizes on the diverse patterns inherent in unlabeled data, transforming this data space into one that is more conducive to classification. Concurrently, adversarial agents in the reinforcement learning algorithm interact competitively, progressively enhancing their ability to intelligently classify and select samples. To reduce the reliance on labeled data and effectively exploit them, we utilize a pseudo-labeling process for pre-training. Experimental results indicate that the proposed model achieves more effective classification while requiring less labeled data compared to other baseline models for known attacks. By inheriting the advantages of VAE, promising results demonstrate that the proposed system detects unknown attacks containing similar or completely different characteristics with high F1 scores exceeding 0.9 and 0.84, respectively. Finally, the proposed system was demonstrated to be a lightweight model for the expeditious detection of malevolent messages introduced into in-vehicle networks to ensure minimal latency.

Detecting Poisoning Attacks in Collaborative IDSs of Vehicular Networks Using XAI and Shapley Value

Machine learning-based Intrusion Detection Systems (IDSs) for vehicle networks can collaborate to enhance their performance by sharing crucial decisions when individual datasets lack diversity, which hinders effective model training. However, such collaborative coalitions are vulnerable to poisoning attacks, where certain members tamper with training data, leading to wrong predictions by the IDSs. The current solutions to this problem have the following issues: 1) They require accessing the training dataset of IDSs, which raises critical privacy concerns; 2) Their heavy reliance on voting mechanisms may exclude clients and fail to detect malicious coalition members when attackers form the majority coalition; and 3) The verification process can potentially expose sensitive information, posing privacy risks. To address these issues and improve the resilience of collaborative IDSs against poisoning attacks, we propose a novel approach that combines XAI (Explainable AI) technology with Shapley value from cooperative game theory. XAI justifies IDS decisions, while the Shapley value identifies poisoning attacks in training datasets by capturing contradictions between explanations and decisions. We tested our implementation using a publicly available dataset and various machine learning models (e.g., RFC, SVM and LSTM). Our results prove highly promising in detecting poisoning attacks and overcoming the flaws in existing solutions.

Evaluating the Effectiveness of Machine Learning-Based Intrusion Detection in Multi-Cloud Environments

In the dynamic landscape of cloud computing, multi-cloud environments have emerged as the prevalent ones due to offering a host of advantages including redundancy, flexibility, and increased security. These multi-cloud environments can, however, be vulnerable to stealthy cyber-attacks, thereby making it a challenging job to find efficient intrusion detection systems (IDS). The efficiency of the Machine Learning-based Intrusion Detection System in multi-cloud environments has been evaluated using a 1-D Convolutional Neural Network to classify network traffic based on the UNSW-NB15 dataset. The dataset included a wide variety of network features, and it was decided that it could be used directly after converting the categorical variables into their numerical forms and scaling them with MinMaxScaler. This was used for training and testing the 1D-CNN model, which had attained an accuracy of 84.02% during training and 82.79% on validation. Further, the performance of the model is elicited with metrics that include precision at 80.91%, recall at 82.79%, and an F1-score at 81.28%, showing its capability in identifying network intrusions effectively. The small difference between the accuracy of training and validation shows that overfitting was minimal; thus, the model will generalize well when applied to unseen data. This research underlines the possibility of using deep learning techniques, and particularly CNNs, for intrusion detection in complex multi-cloud infrastructures. Probably future work would be optimizing the model through hyperparameter tuning, using additional sources of data, and even exploring much more sophisticated architectures that will further improve the accuracy of intrusion detection.

Empirical evaluation of feature selection methods for machine learning based intrusion detection in IoT scenarios

This paper delves into the critical need for enhanced security measures within the Internet of Things (IoT) landscape due to inherent vulnerabilities in IoT devices, rendering them susceptible to various forms of cyber-attacks. The study emphasizes the importance of Intrusion Detection Systems (IDS) for continuous threat monitoring. The objective of this study was to conduct a comprehensive evaluation of feature selection (FS) methods using various machine learning (ML) techniques for classifying traffic flows within datasets containing intrusions in IoT environments. An extensive benchmark analysis of ML techniques and FS methods was performed, assessing feature selection under different approaches including Filter Feature Ranking (FFR), Filter-Feature Subset Selection (FSS), and Wrapper-based Feature Selection (WFS). FS becomes pivotal in handling vast IoT data by reducing irrelevant attributes, addressing the curse of dimensionality, enhancing model interpretability, and optimizing resources in devices with limited capacity. Key findings indicate the outperformance for traffic flows classification of certain tree-based algorithms, such as J48 or PART, against other machine learning techniques (naive Bayes, multi-layer perceptron, logistic, adaptive boosting or k-Nearest Neighbors), showcasing a good balance between performance and execution time. FS methods' advantages and drawbacks are discussed, highlighting the main differences in results obtained among different FS approaches. Filter-feature Subset Selection (FSS) approaches such as CFS could be more suitable than Filter Feature Ranking (FFR), which may select correlated attributes, or than Wrapper-based Feature Selection (WFS) methods, which may tailor attribute subsets for specific ML techniques and have lengthy execution times. In any case, reducing attributes via FS has allowed optimization of classification without compromising accuracy. In this study, F1 score classification results above 0.99, along with a reduction of over 60% in the number of attributes, have been achieved in most experiments conducted across four datasets, both in binary and multiclass modes. This work emphasizes the importance of a balanced attribute selection process, taking into account threat detection capabilities and computational complexity.

Network Intrusion Detection Based on Machine Learning Classification Algorithms: A Review

The worldwide internet continues to spread, presenting numerous escalating hazards with significant potential. Existing static detection systems necessitate frequent updates to signature-based databases and solely detect known malicious threats. Efforts are currently being made to develop network intrusion detection systems that can utilize machine learning techniques to accurately detect and classify hazardous content. This would result in a decrease in the overall workload required. Network Intrusion Detection Systems are created with a diverse range of machine learning algorithms. The objective of the review is to provide a comprehensive overview of the existing machine learning-based intrusion detection systems, with the aim of assisting those involved in the development of network intrusion detection systems.

Implementation of Lightweight Machine Learning-Based Intrusion Detection System on IoT Devices of Smart Homes

Smart home devices, also known as IoT devices, provide significant convenience; however, they also present opportunities for attackers to jeopardize homeowners’ security and privacy. Securing these IoT devices is a formidable challenge because of their limited computational resources. Machine learning-based intrusion detection systems (IDSs) have been implemented on the edge and the cloud; however, IDSs have not been embedded in IoT devices. To address this, we propose a novel machine learning-based two-layered IDS for smart home IoT devices, enhancing accuracy and computational efficiency. The first layer of the proposed IDS is deployed on a microcontroller-based smart thermostat, which uploads the data to a website hosted on a cloud server. The second layer of the IDS is deployed on the cloud side for classification of attacks. The proposed IDS can detect the threats with an accuracy of 99.50% at cloud level (multiclassification). For real-time testing, we implemented the Raspberry Pi 4-based adversary to generate a dataset for man-in-the-middle (MITM) and denial of service (DoS) attacks on smart thermostats. The results show that the XGBoost-based IDS detects MITM and DoS attacks in 3.51 ms on a smart thermostat with an accuracy of 97.59%.

Enhancing Cybersecurity in Smart Grids through Machine Learning-Based Intrusion Detection Systems

Smart grids represent the modernization of electrical grids by integrating advanced communication and information technology. However, their interconnected nature and reliance on digital infrastructure make them vulnerable to cyber-attacks. Enhancing cybersecurity in smart grids is paramount to ensure reliability and safety. This paper explores the use of Machine Learning-Based Intrusion Detection Systems (ML-IDS) as a solution to enhance the cybersecurity of smart grids. It examines the current cybersecurity challenges in smart grids, the fundamentals of intrusion detection systems, the integration of machine learning in IDS, and the effectiveness of ML-IDS in mitigating cyber threats.

ROSPaCe: Intrusion Detection Dataset for a ROS2-Based Cyber-Physical System and IoT Networks

Most of the intrusion detection datasets to research machine learning-based intrusion detection systems (IDSs) are devoted to cyber-only systems, and they typically collect data from one architectural layer. Often the attacks are generated in dedicated attack sessions, without reproducing the realistic alternation and overlap of normal and attack actions. We present a dataset for intrusion detection by performing penetration testing on an embedded cyber-physical system built over Robot Operating System 2 (ROS2). Features are monitored from three architectural layers: the Linux operating system, the network, and the ROS2 services. The dataset is structured as a time series and describes the expected behavior of the system and its response to ROS2-specific attacks: it repeatedly alternates periods of attack-free operation with periods when a specific attack is being performed. This allows measuring the time to detect an attacker and the number of malicious activities performed before detection. Also, it allows training an intrusion detector to minimize both, by taking advantage of the numerous alternating periods of normal and attack operations.

Blockchain Assisted Fireworks Optimization with Machine Learning based Intrusion Detection System (IDS)

Blockchain Assisted Fireworks Optimization with Machine Learning based Intrusion Detection System (IDS)

ResNet50-1D-CNN: A new lightweight resNet50-One-dimensional convolution neural network transfer learning-based approach for improved intrusion detection in cyber-physical systems

The cyber-physical system (CPS) plays a crucial role in supporting critical infrastructure like water treatment facilities, gas stations, air conditioning components, and smart grids, which are essential to society. However, these systems are facing a growing susceptibility to a wide range of emerging attacks. Cyber-attacks against CPS have the potential to cause disruptions in the accurate sensing and actuation processes, resulting in significant harm to physical entities and posing concerns for the overall safety of society. Unlike common security measures like firewalls and encryption, which often aren't enough to deal with the unique problems that CPS architectures present, deploying machine learning-based intrusion detection systems (IDS) that are specifically made for CPS has become an important way to make them safer. The application of machine learning algorithms has been suggested as a means of mitigating cyber-attacks on CPS. However, the limited availability of labelled data pertaining to emerging attack techniques poses a significant challenge to the accurate detection of such attacks. In the given scenario, transfer learning emerges as a promising methodology for the detection of cyber-attacks, as it involves the implicit modelling of the system. In this research, we propose a new lightweight transfer learning method via ResNet50-CNN1D for intrusion detection in CPS. The Adaptive Gradient (Adagrad) optimizer was applied in the proposed model to minimize the loss function through the adjustment of network weight. We tested how well the suggested ResNet50-1D-CNN model worked using the UNSW-NB15 dataset and a control system dataset called HAI. The HAI dataset was taken from the testbed and based on a planned physical attack scenario. By calculating the coefficient scores for the top ten (10) features in the HAI and UNSW-NB15 data, it was possible to determine the relevance of a feature. The rationale behind employing transfer learning was to mitigate the complexity associated with the classification of cyber-attacks and runtime. The utilization of transfer learning resulted in notable reductions in both the training and testing times required for the detection of attacks. On the HAI data, the results showed an accuracy of 97.32 %, recall of 98.41 %, F1-score of 96.32 %, and precision of 97.09 %. On the UNSW-NB15 data, the results showed an accuracy of 99.89 %, recall of 99.09 %, F1-score of 98.01 %, and precision of 98.70 %.

A review on machine learning based intrusion detection system for internet of things enabled environment

Within an internet of things (IoT) environment, the fundamental purpose of various devices is to gather the abundant amount of data that is being generated and then transmit this data to the predetermined server over the internet. IoT connects billions of objects and the internet to communicate without human intervention. But network security and privacy issues are increasing very fast, in today's world. Because of the prevalence of technological advancement in regular activities, internet security has evolved into a necessary requirement. Because technology is integrated into every aspect of contemporary life, cyberattacks on the internet of things represent a bigger danger than attacks against traditional networks. Researchers have found that combining machine learning techniques into an intrusion detection system (IDS) is an efficient way to get beyond the limitations of conventional IDSs in an IoT context. This research presents a comprehensive literature assessment and develops an intrusion detection system that makes use of machine learning techniques to address security problems in an IoT environment. Along with a comprehensive look at the state of the art in terms of intrusion detection systems for IoT-enabled environments, this study also examines the attributes of approaches, common datasets, and existing methods utilized to construct such systems.

Strengthening Wireless Network Security: Supervised Machine Learning-Based Intrusion Detection for Enhanced Threat Mitigation

With the wireless networks deemed vital to our laced and unetched world, it has become fundamental to safeguard these networks against the various cyber threats that are on the rise. As a research proposal I show concern about the application of a Supervised Machine Learning-Based Intrusion Detection system, making use of Multilayer Perceptron (MLP), Support Vector Machine (SVM), and Logistic Regression (LR) algorithms. The survey begins with the introduction of an intrusive inter-dataset technology that merges two catalytic datasets into a single efficient model that can address both model security and data sensitivity concerns. The evaluation of several machine learning algorithms within the proposed framework is a core component of the analysis. The accuracy measure as well as others such as recall, precision, and F1 score, are applied to evaluate the algorithms' level in detecting intrusions from different datasets.The investigation shows that the intra-dataset routing noticeably improves the detecting modules' efficiency. Notably, the model of MLP algorithm has enhanced recall which in turn shows the enhancement of the positive instance identification. SVM shows increased precision, which accounts for the improved accuracy since correct names of positive cases are produced more often. LR finds it overall enhance the precisions thus attesting to its efficiency in correct deductions. The research documents the multifaceted nature of IDS, prompting the intervention of the machine learning algorithms with ddoswdelcome intrusion detection system. A study which provides a practical guide for network administrators and security professionals hinting on how to select algorithms to meet the distinct security needs in their enterprises. These findings contribute to the open discourse on wireless network security and serve as a base for future study of this engaging research topic in constantly developing field of intrusion detection.

MLSTL-WSN: machine learning-based intrusion detection using SMOTETomek in WSNs

In the domain of cyber-physical systems, wireless sensor networks (WSNs) play a pivotal role as infrastructures, encompassing both stationary and mobile sensors. These sensors self-organize and establish multi-hop connections for communication, collectively sensing, gathering, processing, and transmitting data about their surroundings. Despite their significance, WSNs face rapid and detrimental attacks that can disrupt functionality. Existing intrusion detection methods for WSNs encounter challenges such as low detection rates, computational overhead, and false alarms. These issues stem from sensor node resource constraints, data redundancy, and high correlation within the network. To address these challenges, we propose an innovative intrusion detection approach that integrates machine learning (ML) techniques with the Synthetic Minority Oversampling Technique Tomek Link (SMOTE-TomekLink) algorithm. This blend synthesizes minority instances and eliminates Tomek links, resulting in a balanced dataset that significantly enhances detection accuracy in WSNs. Additionally, we incorporate feature scaling through standardization to render input features consistent and scalable, facilitating more precise training and detection. To counteract imbalanced WSN datasets, we employ the SMOTE-Tomek resampling technique, mitigating overfitting and underfitting issues. Our comprehensive evaluation, using the wireless sensor network dataset (WSN-DS) containing 374,661 records, identifies the optimal model for intrusion detection in WSNs. The standout outcome of our research is the remarkable performance of our model. In binary classification scenarios, it achieves an accuracy rate of 99.78%, and in multiclass classification scenarios, it attains an exceptional accuracy rate of 99.92%. These findings underscore the efficiency and superiority of our proposal in the context of WSN intrusion detection, showcasing its effectiveness in detecting and mitigating intrusions in WSNs.

A Review of Machine Learning-based Intrusion Detection System

Intrusion detection systems are mainly prevalent proclivity within our culture today. Interference exposure systems function as countermeasures to identify web-based protection threats. This is a computer or software program that monitors unauthorized network activity and sends alerts to administrators. Intrusion detection systems scan for known threat signatures and anomalies in normal behaviour. This article also analyzed different types of infringement finding systems and modus operandi, focusing on support-vector-machines; Machine-learning; fuzzy-logic; and supervised-learning. For the KDD dataset, we compared different strategies based on their accuracy. Authors pointed out that using support vector machine and machine learning together improves accuracy.

An Intrusion System for Internet of Things Security Breaches Using Machine Learning Techniques

Effective identification and categorization of network attacks are paramount for ensuring robust security. However, contemporary techniques often struggle to accurately discern and classify novel attack patterns. This research introduces an innovative framework designed to achieve reliable attack detection and classification by harnessing the synergistic capabilities of utilizing DenseNet convolutional neural networks and rap music analysis techniques. Our approach leverages feature extraction through the Attention Pyramid Network (RAPNet) framework, tailored to extract pertinent features from input data, alongside binary Pigeon optimization. Subsequently, we employ feature selection using the optimization algorithm (BPOA). Once the optimal features are identified, we employ the Densenet201 model to categorize attacks across various datasets, including Bot-IoT, CICIDS2017, and CICIDS2019, through deep learning methodologies. To address the challenge posed by imbalanced data, we introduce conditional generative adversarial networks for generating additional data samples for minority classes, thus mitigating the issue. In contrast to recent intrusion detection methods, our results showcase the model’s exceptional precision in detecting and categorizing achieving accuracy rates of 99.12%, 99.01%, and 99.18% for Bot-IoT, CICIDS2017, and CICIDS2019 datasets, respectively. Despite the potential benefits of a machine learning-based intrusion detection system (IDS) for Internet of Things (IoT) security, several limitations must be considered. These include the lack of standardized security protocols across various IoT devices and platforms, which makes it challenging to develop a uniform IDS. Furthermore, machine learning models, including those for intrusion detection, can be vulnerable to adversarial attacks that can circumvent or mislead the model’s decision-making process. Thus, the potential for sophisticated attacks on IoT systems must be considered when developing such a system.

Machine Learning-Based Intrusion Detection System for Encrypted Attacks

In today's society, information and communication technology is developing rapidly. With the gradual maturity and popularization of encryption technology, more and more malicious attacks are also using encryption technology to evade the scrutiny of traditional traffic detection systems. Therefore, accurate identification of encrypted attacks has become a research hotspot in the international community. This paper proposes an encrypted traffic detection method based on convolutional neural network (CNN) technology to address the issues of tedious steps and low recognition accuracy in manually extracting traffic features. This method does not require manual or expert feature extraction, and can automatically extract advanced features through CNNs, which are then fed into XGBoost classifiers for classification processing. On the basis of the above methods, this article designs and implements an encrypted traffic intrusion detection system, which is divided into five parts: traffic collection, data processing, model detection, data visualization, and traffic blocking. Reasonable explanations and technical introductions are provided for these modules.