Enhanced Intrusion Detection in Network Traffic via SMOTE‑Augmented Feature Reduction and Ensemble Learning

Abstract

Anomaly detection in network traffic is essential for strengthening cybersecurity and mitigating sophisticated attacks in modern systems. This study presents an advanced machine learning based anomaly detection framework using the NSL-KDD dataset. The framework addresses class imbalance and redundant features through Synthetic Minority Oversampling Technique and Principal Component Analysis, enabling efficient dimensionality reduction and improved learning. Multiple classifiers, including Logistic Regression, Support Vector Machine, Random Forest, Naive Bayes, XGBoost, LightGBM, and Isolation Forest, are implemented to establish strong baseline performance. To further enhance robustness, an ensemble Voting Classifier combining boosted decision trees and bagging based Random Forest models is developed. Explainable AI methods such as SHAP and LIME are integrated to provide transparent feature level interpretations and support trustworthy decision making. Experimental results demonstrate superior performance, with the Voting Classifier achieving 99.7 percent accuracy, precision, recall, and F1 score, outperforming individual models. For real world applicability, the system is deployed using the Flask framework with an SQLite based user signup and signin mechanism. The web interface enables interaction, preprocessing, prediction visualization, and interpretable outputs classified as defective or not defective.