Cascaded Network Intrusion Detection on CICIDS2017

Outcome and proof

The strongest configuration is a two-stage histogram-based gradient boosting cascade evaluated on 2,827,876 cleaned CICIDS2017 flow records.

Context and problem

A binary answer — benign or malicious — does not tell an analyst which attack family they are dealing with. A single multi-class model, however, has to learn rare attack classes while benign traffic dominates the dataset.

My role and responsibility

I built the ingestion, preprocessing, benchmarking, and evaluation pipeline and co-authored the IEEE-format paper with Dr. Muhammad Shafiq at NUST CEME.

Solution and architecture

1. Ingestion — consolidate CICIDS2017 CSV files and normalize malformed values and labels.
2. Preprocessing — build binary and multi-class targets, remove unusable features, rank the remaining features, and standardize the input space.
3. Benchmarking — compare gradient boosting, a 1D-CNN + LSTM, and an autoencoder anomaly detector.
4. Cascade — route suspicious flows from the binary detector to an attack-family classifier.

Key engineering decisions

Separate routing from recognition

The binary detector handles the high-volume routing decision. The second stage focuses model capacity on differentiating malicious traffic.

Report macro and weighted F1 together

Weighted F1 is strong because common classes dominate the dataset. Macro F1 exposes the weaker performance on rare attack families and makes the class-imbalance tradeoff visible.

Verified results

The measured figures above come from the cleaned experiment artifact and are documented alongside generated figures in the public repository.

Visual evidence

The cascade diagram above mirrors the evaluated system: benign traffic exits after the binary stage, while suspicious traffic continues to attack-family recognition.

Technology stack

Python, scikit-learn, histogram-based gradient boosting, 1D-CNN + LSTM models, autoencoders, and Jupyter.