Advancing Network Intrusion Detection: A Comparative Study of Clustering and Classification on NSL-KDD Data
Pavan Nutalapati, Jayapal Reddy Vummadi, Suresh Dodda, Navin Kamuni
Abstract
Since cyberattacks are happening more and more often and are becoming more advanced, network intrusion detection is gaining greater importance. In this study, supervised and unsupervised machine learning models are used to find network attacks using the NSL-KDD dataset that contains both normal and suspicious traffic. Unsupervised approaches such as K-Means and DBSCAN are used to discover natural groups among network flows, and supervised ways like Logistic Regression, Random Forest, Artificial Neural Networks, and XGBoost + K-Means are applied to classify various kinds of network traffic. It was found that the combination of Hybrid XGBoost and K-Means performs the best, scoring 98% in accuracy and 99% on precision, recall, and F1-score. In contrast, DBSCAN struggles with separating the groups, proving that unsupervised methods need additional approaches to be effective. It was found in this research that blending clustering and advanced classification strategies within machine learning boosts the accuracy and stability of systems designed for detecting intrusions.