Passive Hybrid Network-Based Intrusion Detection System (Hybrid-NIDS) Combining Suricata and Random Forest

Benchmark success versus operational reality: a controlled evaluation of Suricata-Random Forest correlation reveals substantial domain shift and near-zero recall on live traffic.

Quoc-Cuong Tang; Hoang-Lam Huynh; Van-Tri Phan; Khuong Nguyen-An· 2026· DOI 10.48550/arXiv.2609.24393

The core problem

Network-based Intrusion Detection Systems (NIDS) are a cornerstone of modern cybersecurity defense, yet their operational effectiveness often diverges sharply from benchmark performance. This paper evaluates a passive Hybrid Network-based Intrusion Detection System (Hybrid-NIDS) prototype that integrates Suricata—a signature-based intrusion detection engine—with Random Forest flow classification and centralized ELK-based alert handling. The authors explicitly separate benchmark evaluation from PCAP/live operational validation, a methodological choice that proves critical to the study's findings. The central research question is whether combining Suricata with machine learning-based flow classification improves operational detection compared to Suricata alone. To address this, the study controls for exact feature-duplicate leakage using feature hashing and group-aware splitting, ensuring that the benchmark evaluation reflects genuine generalization rather than memorization. The paper's contribution lies not in demonstrating a superior detection system, but in rigorously exposing the gap between benchmark metrics and real-world deployment performance.

Innovation

On the prepared hold-out set, RF-41 achieved an F_{1} score of 0.971360 and a ROC-AUC of 0.999671. The NFStream-compatible RF-21 model achieved an F_{1} score of 0.970148 on the same boundary. These results indicate near-perfect classification performance on the benchmark dataset, with minimal degradation from feature reduction. However, operational validation revealed a stark contrast. On a labeled laboratory PCAP, both RF-21 and the strictly correlated branch achieved a recall of only 0.0095—meaning the system detected less than 1% of actual attacks. Furthermore, RF-21 produced no alerts across five additional 60-second attack sessions. In an unlabeled normal-traffic test, the system generated 439 alerts from 2,375 flows, yielding an alert ratio of approximately 0.185. The authors explicitly refrain from interpreting this as a false-positive rate due to the lack of ground-truth labels. These findings underscore a severe benchmark-to-deployment domain shift. The high F_{1} and ROC-AUC scores on UNSW-NB15 do not translate into operational detection capability. The recall of 0.0095 on the labeled PCAP is particularly alarming, suggesting that the model's learned features are highly specifi

Network-based Intrusion Detection Systems (NIDS) are a cornerstone of modern cybersecurity defense, yet their operational effectiveness often diverges sharply from benchmark performance. This paper evaluates a passive Hybrid Network-based Intrusion Detection System (Hybrid-NIDS) prototype that integrates Suricata—a signature-based intrusion detection engine—with Random Forest flow classification and centralized ELK-based alert handling. The authors explicitly separate benchmark evaluation from PCAP/live operational validation, a methodological choice that proves critical to the study's findings. The central research question is whether combining Suricata with machine learning-based flow classification improves operational detection compared to Suricata alone. To address this, the study controls for exact feature-duplicate leakage using feature hashing and group-aware splitting, ensuring that the benchmark evaluation reflects genuine generalization rather than memorization. The paper's contribution lies not in demonstrating a superior detection system, but in rigorously exposing the gap between benchmark metrics and real-world deployment performance.

The Hybrid-NIDS architecture comprises three core components: Suricata for signature-based detection, a Random Forest classifier for flow-based anomaly detection, and an ELK (Elasticsearch, Logstash, Kibana) stack for centralized alert aggregation and correlation. The system operates passively, meaning it monitors network traffic without actively blocking or modifying packets.

Why it matters

The study's central finding is that strong performance on a public benchmark does not directly translate into operational effectiveness. The near-zero recall on the labeled PCAP and the absence of alerts in live attack sessions indicate that the Random Forest models, despite their high F_{1} scores, are not detecting real intrusions in the operational environment. This domain shift likely arises from differences in traffic characteristics, feature distributions, and attack manifestations between the UNSW-NB15 dataset and the laboratory network. The authors also note that the reported experiments do not demonstrate that Suricata-Random Forest correlation provides better operational detection than Suricata alone. This is a critical caveat: the hybrid approach, while theoretically appealing, did not yield operational benefits in this prototype. The alert ratio from normal traffic (439 alerts from 2,375 flows) suggests a high volume of alerts, but without ground-truth labels, its significance remains ambiguous. The paper's methodological rigor in controlling for feature-duplicate leakage and separating benchmark from operational validation is commendable. It highlights the importance of domain adaptation and realistic testing in NIDS research. The current Hybrid-NIDS should be interpreted as a passive prototype and evaluation framework rather than a deployable solution. Future work should focus on bridging the domain gap, perhaps through transfer learning, adversarial validation, or incorporating more diverse training data that reflects operational conditions.

Who should read this

CS practitioners and researchers

Opening member content…