| ABSTRACT |
Conventional Network Intrusion Detection Systems (NIDS) primarily rely on signature-based detection methods. These systems compare network traffic against a database of known threat patterns. While effective against documented attacks, signature-based approaches fail to detect novel or "Zero-Day" anomalies that do not match pre-existing rules. Furthermore, maintaining an up-to-date signature database requires constant manual intervention, creating a window of vulnerability between the emergence of a threat and the deployment of a corresponding signature. To address these limitations, machine learning (ML) approaches have been introduced. However, existing ML-based NIDS often rely on complex deep learning architectures that require substantial computational power (CPU/GPU) and memory. Such requirements make them unsuitable for deployment in resource-constrained environments, such as edge networks, Small and Medium Enterprises (SMEs), or Internet of Things (IoT) gateways. Additionally, many ML-based systems operate as "Black Boxes," providing alerts without explainable reasoning, which reduces the confidence of network administrators in authorizing automated blocking. Furthermore, most existing solutions operate passively. They detect and log intrusions but do not possess the capability to actively mitigate them in real-time. The reliance on manual intervention by a human administrator introduces a significant time lag often referred to as the "response gap" during which a detected threat can propagate laterally across the network to infect other nodes. Existing active defence solutions (Intrusion Prevention Systems) are typically hardware-intensive and located inline at the network perimeter, failing to address internal lateral movement between host devices. Therefore, there is a need for a lightweight, hybrid intrusion detection and defence system that combines the speed of deterministic detection with the adaptability of probabilistic anomaly detection, while providing automated, distributed mitigation capabilities suitable for edge computing environments.
|