%0 Journal Article %1 cho2026pcapaide %A Cho, Sung-Jun %D 2026 %J International Journal of Computer Networks & Communications (IJCNC) %K AI CIC-IDS2018 Detection Engineering Explainable False Feature Flow-Level Forest Hybrid Intrusion NIDS Network Positive Random Reduction Reproducibility SHAP UNSW-NB15 %N 4 %P 75-96 %R 10.5121/ijcnc.2026.18405 %T PCAP-AIDE: AN EXPORTER-FREE HYBRID NIDS WITH AUTOMATED FLOW-LEVEL FEATURE ENGINEERING AND SHAP-GUIDED FALSE POSITIVE REDUCTION %U https://aircconline.com/ijcnc/V18N4/18426cnc05.pdf %V 18 %X Modern enterprise networks face an escalating volume of sophisticated cyber-attacks that traditional signature-based network intrusion detection systems (NIDS) fail to counter. Existing machine learning (ML)-based NIDS (ML-NIDS) exhibit three fundamental operational limitations: (i) dependency on proprietary flow exporters that create vendor lock-in and restrict privacy-sensitive deployments; (ii) susceptibility to class imbalance that degrades generalization across heterogeneous attack categories; and (iii) opaque decision processes that erode operational trust and hinder alert triage. These gaps collectively prevent ML-NIDS from achieving reliable, reproducible, and explainable detection in real-world deployments. This paper presents a new packet capture artificial intelligence detection engine (PCAPAIDE), an open-source hybrid NIDS that addresses all three limitations through four coordinated contributions: (C1) a self-contained 35-dimensional flow feature extractor operating directly on raw PCAP or standard CSV records, eliminating exporter dependency; (C2) stratified reservoir sampling with a class of weight-balanced random forest (RF) classifier, providing imbalance-resilient training on datasets exceeding 2.5 million flows; (C3) FlowFPFilter v3.0, a SHAP-guided post-processing filter that reduces false positives by 22.9% while preserving recall; and (C4) a five-protocol robustness evaluation framework that rules out data-leakage artefacts and confirms statistical stability across algorithm variants and random seeds. Evaluated on CIC-IDS2018 and the complete four-part UNSW-NB15 dataset (2.54 M flows; nine attack categories), PCAP-AIDE achieves F1 = 0.9997 and F1 = 0.9919, respectively, surpassing the AdvIDS-2025 baseline by ΔF1 = +0.0729 and +0.0479. FPR on UNSW-NB15 is 0.0144 — within the operational acceptance threshold of <2%. Ten-seed variance analysis confirms F1 standard deviations of 0.0001 (CIC) and 0.0005 (UNSW). PCAP-AIDE is released as a fully open-source pipeline, providing a deployment-ready, interpretable, and statistically validated solution for modern network security.

@article{cho2026pcapaide, abstract = {Modern enterprise networks face an escalating volume of sophisticated cyber-attacks that traditional signature-based network intrusion detection systems (NIDS) fail to counter. Existing machine learning (ML)-based NIDS (ML-NIDS) exhibit three fundamental operational limitations: (i) dependency on proprietary flow exporters that create vendor lock-in and restrict privacy-sensitive deployments; (ii) susceptibility to class imbalance that degrades generalization across heterogeneous attack categories; and (iii) opaque decision processes that erode operational trust and hinder alert triage. These gaps collectively prevent ML-NIDS from achieving reliable, reproducible, and explainable detection in real-world deployments. This paper presents a new packet capture artificial intelligence detection engine (PCAPAIDE), an open-source hybrid NIDS that addresses all three limitations through four coordinated contributions: (C1) a self-contained 35-dimensional flow feature extractor operating directly on raw PCAP or standard CSV records, eliminating exporter dependency; (C2) stratified reservoir sampling with a class of weight-balanced random forest (RF) classifier, providing imbalance-resilient training on datasets exceeding 2.5 million flows; (C3) FlowFPFilter v3.0, a SHAP-guided post-processing filter that reduces false positives by 22.9% while preserving recall; and (C4) a five-protocol robustness evaluation framework that rules out data-leakage artefacts and confirms statistical stability across algorithm variants and random seeds. Evaluated on CIC-IDS2018 and the complete four-part UNSW-NB15 dataset (2.54 M flows; nine attack categories), PCAP-AIDE achieves F1 = 0.9997 and F1 = 0.9919, respectively, surpassing the AdvIDS-2025 baseline by ΔF1 = +0.0729 and +0.0479. FPR on UNSW-NB15 is 0.0144 — within the operational acceptance threshold of <2%. Ten-seed variance analysis confirms F1 standard deviations of 0.0001 (CIC) and 0.0005 (UNSW). PCAP-AIDE is released as a fully open-source pipeline, providing a deployment-ready, interpretable, and statistically validated solution for modern network security.}, added-at = {2026-09-02T11:45:15.000+0200}, author = {Cho, Sung-Jun}, biburl = {https://www.bibsonomy.org/bibtex/2f0c085a21c0a25d9c2587b3371d52f33/laimbee}, description = {DNA damage induced by bleomycin, neocarzinostatin, and melphalan in a precisely positioned nucleosome. Asymmetry in protection at the periphery of nucleosome-bound DNA.}, doi = {10.5121/ijcnc.2026.18405}, interhash = {a08e291f93157e1554de0d91c5843be2}, intrahash = {f0c085a21c0a25d9c2587b3371d52f33}, issn = {0974 - 9322 (Online); 0975 - 2293 (Print)}, journal = {International Journal of Computer Networks & Communications (IJCNC)}, keywords = {AI CIC-IDS2018 Detection Engineering Explainable False Feature Flow-Level Forest Hybrid Intrusion NIDS Network Positive Random Reduction Reproducibility SHAP UNSW-NB15}, language = {English}, month = {July}, number = 4, pages = {75-96}, timestamp = {2026-09-02T11:45:15.000+0200}, title = {PCAP-AIDE: AN EXPORTER-FREE HYBRID NIDS WITH AUTOMATED FLOW-LEVEL FEATURE ENGINEERING AND SHAP-GUIDED FALSE POSITIVE REDUCTION}, url = {https://aircconline.com/ijcnc/V18N4/18426cnc05.pdf}, volume = 18, year = 2026 }