Text-overlap comparison
This pair was found by matching on title alone (find_title_bucket_dupes.py) — the usual paragraph-embedding similarity search never generated a candidate for it at any threshold. The exhibits below are near-exact word-shingle matches instead — a multi-word verbatim run is the more convincing evidence of shared text than embedding similarity, with the matched span highlighted.
PAPER A
PAPER B
PARAGRAPH A¶10-15
for multiclass classification, the CSE-CIC-IDS 2018 dataset has been used for system evaluation. The CSECIC-IDS 2018 dataset was subjected to several preprocessing techniques to prepare it for the training phase. The proposed model has been implemented in 100,000 instances of a sample dataset. Toldinas, et al. [10]. proposed a novel approach for network intrusion detection using multistage deep learning image recognition. The network features are transformed into four-channel (Red, Green, Blue, and Alpha) images. The images then are used for classification to train and test the pre-trained deep learning model ResNet50. The proposed approach is evaluated using two publicly available benchmark datasets, UNSW-NB15 and BOUN Ddos. On the UNSW-NB15 dataset, the proposed approach achieves 99.8% accuracy in the detection of the generic attack. On the BOUN DDos dataset, the suggested approach achieves 99.7% accuracy in the detection of the DDos attack and 99.7% accuracy in the detection of the normal traffic. Zhang, et al. [11] proposed a novel algorithm based on both wavelet leader multifractal analysis (WLM) and machine learning (ML) principles. In earlier research on unmanned aerial systems (UAS), intrusion detection systems (IDS) based on multifractal (MF) spectral analysis have been used to provide accurate MF spectrum estimations of network traffic. Such an estimation is then used to detect and characterize flooding anomalies that can be observed in an unmanned aerial vehicle (UAV) network. However, the previous contributions have lacked the consideration of other types of network intrusions commonly observed in UAS networks, such as the man in the middle attack (MITM). In this work, this promising methodology has been accommodated to detect a spoofing attack within a UAS. Ali, et, al. [12] implemented various deep learning models, including multilayer perceptron (MLP), convolutional neural network (CNN), and long short-term memory (LSTM), alongside traditional machine learning algorithms such as logistic regression, naive Bayes, random forest, K-nearest neighbors, and decision trees. Mao, et, al. [13] employed a dynamic routing mechanism to map sample feature vectors into robust class vector representations, achieving superior generalization when detecting unseen attack types. Compared to existing FCN–Transformer models, MFEI-IDS incorporates inductive learning to handle data imbalance and small-sample scenarios. Experiments on ISCX 2012 and CIC-IDS 2017 datasets show that MFEI-IDS outperforms mainstream IDS methods in accuracy, precision, recall, and F1-score, excelling in crossdataset validation and demonstrating strong generalization capabilities. Mari, et al. [14] demonstrated a way to create adversarial instances of network traffic that can be used to evade detection by a machine learning-based IDS. Moreover, this traffic can be used for training in order to improve performance in the case of new attacks. Thus, a generative adversarial network (GAN) i.e., an architecture based on a deeplearning algorithm capable of creating generative models was implemented. Rekha Gangula et al. [15] proposed an IoT intrusion detection system using an Enhanced Flower Pollination Algorithm with an ensemble classifier. The optimization technique selected optimal features and parameters. The ensemble model improved classification robustness and reduced false alarms. 3. PROPOSED SYSTEM The proposed system architecture processes raw network traffic by applying preprocessing and waveletbased feature extraction to generate informative and discriminative inputs for analysis. Discrete Wavelet Transform (DWT) is used to capture variations and hidden patterns within network data, improving feature quality. These processed features are then fed into machine learning models that perform anomaly detection and authentication failure classification with high accuracy. The system is designed to identify subtle deviations in network behavior, including unusual traffic patterns and irregular login activities. By integrating wavelet-based features with classification algorithms, the framework enhances detection
PARAGRAPH B¶13-21
Kim, et al. [8] Multipath errors are significantly challenging in radio navigation systems. Multipath errors in outdoor environments, such as in global navigation satellite system (GNSS) signal applications, have been widely studied for precise positioning. Multipath mitigation methods using a shallow neural network and a transfer learning-based deep neural network were respectively considered to overcome the complexity caused by the reflected signals in indoor environments. These methods classified each measurement according to whether the measurement exhibits a severe multipath error. Carrier-phase measurements broadcasted from the transmitter were used for the wavelet transform, and the magnitude values after the transform were used for neural network-based learning. Shallow and deep networks attain approximately 87.1% and 85.6% detection accuracies, respectively, and the positioning error can be reduced by 10.4% and 9.4%, respectively, after multipath mitigation. Fu, et al. [9] addressed the issue of low detection accuracy, proposes a model for traffic anomaly detection named a deep learning model for network intrusion detection. In intrusion detection public data sets, there are serious imbalance data generally. To address data imbalance issues, this paper employs the method of adaptive synthetic sampling (ADASYN) for sample expansion of minority class samples, to eventually form a relatively symmetric dataset, and uses a modified stacked autoencoder for data dimensionality reduction with the objective of enhancing information fusion. DLNID is an end-to-end model, so it does not need to undergo the process of manual feature extraction. After being tested on the public benchmark dataset on network intrusion detection NSL-KDD, experimental results show that the accuracy and F1 score of this model are better than those of other comparison methods, reaching 90.73% and 89.65%, respectively. Zhang, et al. [10] proposed a novel algorithm based on both wavelet leader multifractal analysis (WLM) and machine learning (ML) principles. In earlier research on unmanned aerial systems (UAS), intrusion detection systems (IDS) based on multifractal (MF) spectral analysis have been used to provide accurate MF spectrum estimations of network traffic. Such an estimation is then used to detect and characterize flooding anomalies that can be observed in an unmanned aerial vehicle (UAV) network. However, the previous contributions have lacked the consideration of other types of network intrusions commonly observed in UAS networks, such as the man in the middle attack (MITM). In this work, this promising methodology has been accommodated to detect a spoofing attack within a UAS. Ali, et, al. [11] implemented various deep learning models, including multilayer perceptron (MLP), convolutional neural network (CNN), and long short-term memory (LSTM), alongside traditional machine learning algorithms such as logistic regression, naive Bayes, random forest, K-nearest neighbors, and decision trees. Mao, et, al. [12] employed a dynamic routing mechanism to map sample feature vectors into robust class vector representations, achieving superior generalization when detecting unseen attack types. Compared to existing FCN–Transformer models, MFEI-IDS incorporates inductive learning to handle data imbalance and small-sample scenarios. Experiments on ISCX 2012 and CIC-IDS 2017 datasets show that MFEI-IDS outperforms mainstream IDS methods in accuracy, precision, recall, and F1-score, excelling in cross-dataset validation and demonstrating strong generalization capabilities. Mari, et al. [13] demonstrated a way to create adversarial instances of network traffic that can be used to evade detection by a machine learning-based IDS. Moreover, this traffic can be used for training in order to improve performance in the case of new attacks. Thus, a generative adversarial network (GAN) i.e., an architecture based on a deep-learning algorithm capable of creating generative models was implemented. Cao, et al. [14] presented a novel model, called Wavelet Transform-based Dual-Stream Backbone Network (WTDBNet), which effectively integrates three key strengths: the ability of the Transformer to model long-range dependencies for global context, the capability of convolutional neural networks to extract detailed local features, and the efficiency of wavelet transform in frequency-domain decomposition for enhancing edges and texture details. These components are fused via channel and spatial attention mechanisms, thereby improving the model’s ability to extract discriminative features. The effectiveness of WTDBNet is validated on two widely used benchmarks for fine-grained oriented ship detection, as well as on a self-constructed dataset designed to represent complex scenarios. Sun, et al. [15] proposed a framework that combines CNN and Transformer, employs the wavelet transform and inverse wavelet transform for encoding and decoding, and progressively embeds the edge information on the raw image in the encoding processNext, the residual structure Swin Transformer group is used to extract global features. Then, the resulting feature map and the encoder’s hybrid feature map are used for high-resolution feature map reconstruction by the decoder. The experimental results show that the proposed method can achieve an excellent effect in edge information protection and visual reconstruction of images. In addition, the effectiveness of each component of the proposed model is verified by ablation experiments. 3. PROPOSED SYSTEM The proposed system architecture operates by transforming raw network traffic into highly discriminative, multi-scale features using wavelet decomposition and advanced preprocessing, followed by intelligent classification layers that detect anomalies and authentication failures with high accuracy. The entire pipeline is designed to capture long-range attack patterns, subtle deviations in login behaviors, and complex packet-level variations that traditional systems fail to interpret. By combining Multi-Scale Wavelet Processing with powerful machine-learning decision layers, the system enhances sensitivity, reduces false alarms, and ensures robust, real-time intrusion detection suitable for enterprise and defense network environments as shown in fig. 2.
PARAGRAPH A¶16-21
capability and reduces false positives. Data balancing techniques further improve model reliability when handling imbalanced datasets. The architecture supports both training and real-time prediction through an efficient pipeline. The system provides a scalable and effective solution for network intrusion detection, as illustrated in Figure 2. Figure 2: Proposed system architecture Raw Network Data Acquisition: The operational flow begins with the continuous acquisition of raw network traffic from distributed security endpoints such as routers, gateways, authentication servers, and firewall logs. This stage is crucial because long-range intrusion patterns require diverse multi-source data to identify deviations and subtle attack footprints. The system collects packet headers, connection metadata, frequency of requests, session durations, and access logs that capture both successful and failed authentication attempts. These inputs serve as the foundational evidence for detecting anomalies and unusual traffic bursts that may not be visible when using single-source monitoring systems. Data Preprocessing and Cleaning: Once data enters the pipeline, the preprocessing layer transforms it into a standardized and noise-free structure suitable for advanced analytics. This step removes corrupted packets, duplicate entries, and incomplete authentication logs, ensuring that only meaningful and validated data flows into further processing. Normalization techniques are applied to maintain uniform scaling across diverse numerical attributes such as packet size, request count, and login intervals. Temporal alignment is also performed so that long-range dependencies such as slow attacks or progressive intrusion attempts— can be captured more accurately across chronological event sequences. Multi-Scale Wavelet Decomposition: The next stage introduces the core innovation of the proposed system: multi-scale wavelet decomposition. Unlike traditional filters or time-domain transformations, wavelets analyze network signals at multiple resolutions simultaneously, allowing the system to detect both sudden anomalies (burst attacks) and long-term deviations (slow-paced intrusions). During this process, the raw data is decomposed into approximate (low-frequency) and detailed (high-frequency) components, revealing hidden fluctuations that attackers often exploit to bypass classic IDS models. This multiresolution representation significantly enhances the system’s ability to sense micro-level variations in packet flow and macro-level authentication irregularities. Feature Engineering and Selection: After wavelet transformation, the system begins engineering features that capture the intelligence embedded within the decomposed signals. This step extracts statistical
PARAGRAPH B¶21-26
3. PROPOSED SYSTEM The proposed system architecture operates by transforming raw network traffic into highly discriminative, multi-scale features using wavelet decomposition and advanced preprocessing, followed by intelligent classification layers that detect anomalies and authentication failures with high accuracy. The entire pipeline is designed to capture long-range attack patterns, subtle deviations in login behaviors, and complex packet-level variations that traditional systems fail to interpret. By combining Multi-Scale Wavelet Processing with powerful machine-learning decision layers, the system enhances sensitivity, reduces false alarms, and ensures robust, real-time intrusion detection suitable for enterprise and defense network environments as shown in fig. 2. Fig. 2: Proposed system architecture Raw Network Data Acquisition: The operational flow begins with the continuous acquisition of raw network traffic from distributed security endpoints such as routers, gateways, authentication servers, and firewall logs. This stage is crucial because long-range intrusion patterns require diverse multi-source data to identify deviations and subtle attack footprints. The system collects packet headers, connection metadata, frequency of requests, session durations, and access logs that capture both successful and failed authentication attempts. These inputs serve as the foundational evidence for detecting anomalies and unusual traffic bursts that may not be visible when using single-source monitoring systems. Data Preprocessing and Cleaning: Once data enters the pipeline, the preprocessing layer transforms it into a standardized and noise-free structure suitable for advanced analytics. This step removes corrupted packets, duplicate entries, and incomplete authentication logs, ensuring that only meaningful and validated data flows into further processing. Normalization techniques are applied to maintain uniform scaling across diverse numerical attributes such as packet size, request count, and login intervals. Temporal alignment is also performed so that long-range dependencies such as slow attacks or progressive intrusion attempts—can be captured more accurately across chronological event sequences. Multi-Scale Wavelet Decomposition: The next stage introduces the core innovation of the proposed system: multi-scale wavelet decomposition. Unlike traditional filters or time-domain transformations, wavelets analyze network signals at multiple resolutions simultaneously, allowing the system to detect both sudden anomalies (burst attacks) and long-term deviations (slow-paced intrusions). During this process, the raw data is decomposed into approximate (low-frequency) and detailed (high-frequency) components, revealing hidden fluctuations that attackers often exploit to bypass classic IDS models. This multi-resolution representation significantly enhances the system’s ability to sense micro-level variations in packet flow and macro-level authentication irregularities. Feature Engineering and Selection: After wavelet transformation, the system begins engineering features that capture the intelligence embedded within the decomposed signals. This step extracts statistical indicators such as entropy, variance, spike density, packet symmetry ratios, and login deviation scores, which represent refined patterns of normal and abnormal user behavior. High-dimensional features are then filtered using selection techniques to remove redundant or weak predictors, ensuring that the final
PARAGRAPH A¶17-29
capability and reduces false positives. Data balancing techniques further improve model reliability when handling imbalanced datasets. The architecture supports both training and real-time prediction through an efficient pipeline. The system provides a scalable and effective solution for network intrusion detection, as illustrated in Figure 2. Figure 2: Proposed system architecture Raw Network Data Acquisition: The operational flow begins with the continuous acquisition of raw network traffic from distributed security endpoints such as routers, gateways, authentication servers, and firewall logs. This stage is crucial because long-range intrusion patterns require diverse multi-source data to identify deviations and subtle attack footprints. The system collects packet headers, connection metadata, frequency of requests, session durations, and access logs that capture both successful and failed authentication attempts. These inputs serve as the foundational evidence for detecting anomalies and unusual traffic bursts that may not be visible when using single-source monitoring systems. Data Preprocessing and Cleaning: Once data enters the pipeline, the preprocessing layer transforms it into a standardized and noise-free structure suitable for advanced analytics. This step removes corrupted packets, duplicate entries, and incomplete authentication logs, ensuring that only meaningful and validated data flows into further processing. Normalization techniques are applied to maintain uniform scaling across diverse numerical attributes such as packet size, request count, and login intervals. Temporal alignment is also performed so that long-range dependencies such as slow attacks or progressive intrusion attempts— can be captured more accurately across chronological event sequences. Multi-Scale Wavelet Decomposition: The next stage introduces the core innovation of the proposed system: multi-scale wavelet decomposition. Unlike traditional filters or time-domain transformations, wavelets analyze network signals at multiple resolutions simultaneously, allowing the system to detect both sudden anomalies (burst attacks) and long-term deviations (slow-paced intrusions). During this process, the raw data is decomposed into approximate (low-frequency) and detailed (high-frequency) components, revealing hidden fluctuations that attackers often exploit to bypass classic IDS models. This multiresolution representation significantly enhances the system’s ability to sense micro-level variations in packet flow and macro-level authentication irregularities. Feature Engineering and Selection: After wavelet transformation, the system begins engineering features that capture the intelligence embedded within the decomposed signals. This step extracts statistical indicators such as entropy, variance, spike density, packet symmetry ratios, and login deviation scores, which represent refined patterns of normal and abnormal user behavior. High-dimensional features are then filtered using selection techniques to remove redundant or weak predictors, ensuring that the final dataset contains only the most relevant attributes. This optimization enhances computational efficiency and prevents model overfitting, especially when analyzing large-scale enterprise network traffic. Model Training Using Proposed Machine Learning Algorithms: The processed dataset is then fed into a multi-model learning environment where algorithms like NBC, KNN, and SVC are rigorously trained. Each model is exposed to thousands of labeled samples representing normal behavior, anomalies, and authentication outcomes categorized as positive, negative, or neutral. Cross-validation ensures that the model generalizes well to unseen traffic patterns, while hyperparameter tuning enhances decision boundaries, probabilistic estimations, and nearest-neighbor distances. This training phase equips the proposed system to differentiate between benign fluctuations and genuine attacks with improved precision and reduced false alarms. Real-Time Prediction and Intrusion Detection: During live deployment, the system performs high-speed inference by transforming incoming traffic into wavelet-based features and applying the trained models to classify each event. Every network request is rapidly evaluated to determine whether it represents normal behavior, suspicious activity, or an authentication failure category. Real-time alerts are triggered for anomalies such as brute-force attacks, session hijacking attempts, excessive login failures, or unusual traffic bursts originating from unknown sources. By processing data instantly and intelligently, the system ensures robust early detection of intrusions before they escalate into major security breaches. Continuous Learning and Adaptive Feedback Loop: The final stage introduces adaptive intelligence by feeding system outputs back into the learning layer. Detected anomalies, new attack signatures, and evolving traffic behaviors are stored to update the model’s knowledge base over time. This feedback loop ensures resilience against emerging threats, supporting continuous retraining and self-improvement without requiring manual reconfiguration. As attack patterns evolve—whether through AI-based evasion or longrange stealth techniques—the system dynamically adjusts thresholds, improves classification boundaries, and maintains high detection performance in complex defense-network environments. 4. RESULTS ANALYSIS The results demonstrate the effectiveness of the proposed wavelet-based network intrusion detection framework in analyzing and classifying network traffic. The system successfully integrates data preprocessing, feature extraction, and machine learning models within a unified dashboard for comprehensive analysis. Exploratory data analysis highlights the distribution and characteristics of normal and anomalous network activities, providing insights into dataset composition. Performance evaluation shows that the Naive Bayes classifier achieves superior accuracy compared to KNN and SVC models. Visualizations such as pie charts, histograms, and scatter plots help in understanding feature behavior and relationships. Figure 3 illustrates the distribution of anomalous and normal network traffic instances using a pie chart visualization. The chart shows that approximately 72.9 percent of the dataset corresponds to normal network activity, while 27.1 percent represents anomalous network events. This graphical representation highlights the proportion of security events present in the dataset. Understanding this class distribution is important when designing anomaly detection models since class imbalance may affect classification
PARAGRAPH B¶22-34
Fig. 2: Proposed system architecture Raw Network Data Acquisition: The operational flow begins with the continuous acquisition of raw network traffic from distributed security endpoints such as routers, gateways, authentication servers, and firewall logs. This stage is crucial because long-range intrusion patterns require diverse multi-source data to identify deviations and subtle attack footprints. The system collects packet headers, connection metadata, frequency of requests, session durations, and access logs that capture both successful and failed authentication attempts. These inputs serve as the foundational evidence for detecting anomalies and unusual traffic bursts that may not be visible when using single-source monitoring systems. Data Preprocessing and Cleaning: Once data enters the pipeline, the preprocessing layer transforms it into a standardized and noise-free structure suitable for advanced analytics. This step removes corrupted packets, duplicate entries, and incomplete authentication logs, ensuring that only meaningful and validated data flows into further processing. Normalization techniques are applied to maintain uniform scaling across diverse numerical attributes such as packet size, request count, and login intervals. Temporal alignment is also performed so that long-range dependencies such as slow attacks or progressive intrusion attempts—can be captured more accurately across chronological event sequences. Multi-Scale Wavelet Decomposition: The next stage introduces the core innovation of the proposed system: multi-scale wavelet decomposition. Unlike traditional filters or time-domain transformations, wavelets analyze network signals at multiple resolutions simultaneously, allowing the system to detect both sudden anomalies (burst attacks) and long-term deviations (slow-paced intrusions). During this process, the raw data is decomposed into approximate (low-frequency) and detailed (high-frequency) components, revealing hidden fluctuations that attackers often exploit to bypass classic IDS models. This multi-resolution representation significantly enhances the system’s ability to sense micro-level variations in packet flow and macro-level authentication irregularities. Feature Engineering and Selection: After wavelet transformation, the system begins engineering features that capture the intelligence embedded within the decomposed signals. This step extracts statistical indicators such as entropy, variance, spike density, packet symmetry ratios, and login deviation scores, which represent refined patterns of normal and abnormal user behavior. High-dimensional features are then filtered using selection techniques to remove redundant or weak predictors, ensuring that the final dataset contains only the most relevant attributes. This optimization enhances computational efficiency and prevents model overfitting, especially when analyzing large-scale enterprise network traffic. Model Training Using Proposed Machine Learning Algorithms: The processed dataset is then fed into a multi-model learning environment where algorithms like NBC, KNN, and SVC are rigorously trained. Each model is exposed to thousands of labeled samples representing normal behavior, anomalies, and authentication outcomes categorized as positive, negative, or neutral. Cross-validation ensures that the model generalizes well to unseen traffic patterns, while hyperparameter tuning enhances decision boundaries, probabilistic estimations, and nearest-neighbor distances. This training phase equips the proposed system to differentiate between benign fluctuations and genuine attacks with improved precision and reduced false alarms. Real-Time Prediction and Intrusion Detection: During live deployment, the system performs highspeed inference by transforming incoming traffic into wavelet-based features and applying the trained models to classify each event. Every network request is rapidly evaluated to determine whether it represents normal behavior, suspicious activity, or an authentication failure category. Real-time alerts are triggered for anomalies such as brute-force attacks, session hijacking attempts, excessive login failures, or unusual traffic bursts originating from unknown sources. By processing data instantly and intelligently, the system ensures robust early detection of intrusions before they escalate into major security breaches. Continuous Learning and Adaptive Feedback Loop: The final stage introduces adaptive intelligence by feeding system outputs back into the learning layer. Detected anomalies, new attack signatures, and evolving traffic behaviors are stored to update the model’s knowledge base over time. This feedback loop ensures resilience against emerging threats, supporting continuous retraining and self-improvement without requiring manual reconfiguration. As attack patterns evolve—whether through AI-based evasion or long-range stealth techniques—the system dynamically adjusts thresholds, improves classification boundaries, and maintains high detection performance in complex defense-network environments. 4. RESULTS ANALYSIS The results section presents the key findings of a study in a clear and organized manner. It focuses on displaying the data collected through experiments, surveys, or analysis without interpretation. Typically, results are shown using tables, graphs, or charts to make patterns and trends easy to understand. This section highlights important outcomes, comparisons, and any significant relationships observed in the data. It avoids personal opinions and sticks strictly to factual information. The results section provides the foundation for discussion and conclusions in the research. Fig. 4: Visualizing Key Feature Distributions using Histogram. Fig. 4 depicts the distribution of important network traffic features using histogram-based visualizations. The figure includes histograms for packet size, transmission rate, latency, and CPU usage. Packet size values range approximately between 500 and 1500 units, while transmission rate values range between about 50 and 200 units. Latency values are distributed between roughly 10 and 100 units, and CPU usage ranges between approximately 5 and 90 percent. These distributions help researchers understand how network characteristics vary across the dataset. Such analysis is useful for identifying feature patterns and detecting potential outliers before model training.
PARAGRAPH A¶29-33
performance. The visualization therefore provides an overview of how network events are distributed across normal and anomalous categories. Figure 3: Visualizing anamoly distribution using pie chart. Figure 4 depicts the distribution of important network traffic features using histogram based visualizations. The figure includes histograms for packet size, transmission rate, latency, and CPU usage. Packet size values range approximately between 500 and 1500 units, while transmission rate values range between about 50 and 200 units. Latency values are distributed between roughly 10 and 100 units, and CPU usage ranges between approximately 5 and 90 percent. These distributions help researchers understand how network characteristics vary across the dataset. Such analysis is useful for identifying feature patterns and detecting potential outliers before model training. Figure 4: Visualizing Key Feature Distributions using Histogram. 439 Figure 5 presents the evaluation results obtained after training the selected machine learning models. For anomaly detection classification, Naive Bayes achieved an accuracy of 95.40 percent, precision of 95.89 percent, recall of 95.40 percent, and F1 score of 95.49 percent. The KNN model achieved an accuracy of 82.40 percent with an F1 score of 83.23 percent, while the SVC model achieved an accuracy of 72.30 percent with an F1 score of 73.82 percent. In authentication failure classification, Naive Bayes achieved 100 percent accuracy, precision, recall, and F1 score.
PARAGRAPH B¶32-36
4. RESULTS ANALYSIS The results section presents the key findings of a study in a clear and organized manner. It focuses on displaying the data collected through experiments, surveys, or analysis without interpretation. Typically, results are shown using tables, graphs, or charts to make patterns and trends easy to understand. This section highlights important outcomes, comparisons, and any significant relationships observed in the data. It avoids personal opinions and sticks strictly to factual information. The results section provides the foundation for discussion and conclusions in the research. Fig. 4: Visualizing Key Feature Distributions using Histogram. Fig. 4 depicts the distribution of important network traffic features using histogram-based visualizations. The figure includes histograms for packet size, transmission rate, latency, and CPU usage. Packet size values range approximately between 500 and 1500 units, while transmission rate values range between about 50 and 200 units. Latency values are distributed between roughly 10 and 100 units, and CPU usage ranges between approximately 5 and 90 percent. These distributions help researchers understand how network characteristics vary across the dataset. Such analysis is useful for identifying feature patterns and detecting potential outliers before model training. Fig. 5: Model Performance Comparison Interface for Training and Evaluation. Fig. 5 illustrates the model performance comparison interface used to train and evaluate machine learning algorithms within the system. The interface allows users to select algorithms such as KNN, SVC, and NB for training and evaluation. Through this component, users can initiate the model training process and compare the effectiveness of different classification techniques. The interface supports experimentation with multiple algorithms for anomaly detection and authentication failure classification.
PARAGRAPH A¶29-33
performance. The visualization therefore provides an overview of how network events are distributed across normal and anomalous categories. Figure 3: Visualizing anamoly distribution using pie chart. Figure 4 depicts the distribution of important network traffic features using histogram based visualizations. The figure includes histograms for packet size, transmission rate, latency, and CPU usage. Packet size values range approximately between 500 and 1500 units, while transmission rate values range between about 50 and 200 units. Latency values are distributed between roughly 10 and 100 units, and CPU usage ranges between approximately 5 and 90 percent. These distributions help researchers understand how network characteristics vary across the dataset. Such analysis is useful for identifying feature patterns and detecting potential outliers before model training. Figure 4: Visualizing Key Feature Distributions using Histogram. 439 Figure 5 presents the evaluation results obtained after training the selected machine learning models. For anomaly detection classification, Naive Bayes achieved an accuracy of 95.40 percent, precision of 95.89 percent, recall of 95.40 percent, and F1 score of 95.49 percent. The KNN model achieved an accuracy of 82.40 percent with an F1 score of 83.23 percent, while the SVC model achieved an accuracy of 72.30 percent with an F1 score of 73.82 percent. In authentication failure classification, Naive Bayes achieved 100 percent accuracy, precision, recall, and F1 score.
PARAGRAPH B¶32-36
4. RESULTS ANALYSIS The results section presents the key findings of a study in a clear and organized manner. It focuses on displaying the data collected through experiments, surveys, or analysis without interpretation. Typically, results are shown using tables, graphs, or charts to make patterns and trends easy to understand. This section highlights important outcomes, comparisons, and any significant relationships observed in the data. It avoids personal opinions and sticks strictly to factual information. The results section provides the foundation for discussion and conclusions in the research. Fig. 4: Visualizing Key Feature Distributions using Histogram. Fig. 4 depicts the distribution of important network traffic features using histogram-based visualizations. The figure includes histograms for packet size, transmission rate, latency, and CPU usage. Packet size values range approximately between 500 and 1500 units, while transmission rate values range between about 50 and 200 units. Latency values are distributed between roughly 10 and 100 units, and CPU usage ranges between approximately 5 and 90 percent. These distributions help researchers understand how network characteristics vary across the dataset. Such analysis is useful for identifying feature patterns and detecting potential outliers before model training. Fig. 5: Model Performance Comparison Interface for Training and Evaluation. Fig. 5 illustrates the model performance comparison interface used to train and evaluate machine learning algorithms within the system. The interface allows users to select algorithms such as KNN, SVC, and NB for training and evaluation. Through this component, users can initiate the model training process and compare the effectiveness of different classification techniques. The interface supports experimentation with multiple algorithms for anomaly detection and authentication failure classification.
PARAGRAPH A¶31-35
Figure 4 depicts the distribution of important network traffic features using histogram based visualizations. The figure includes histograms for packet size, transmission rate, latency, and CPU usage. Packet size values range approximately between 500 and 1500 units, while transmission rate values range between about 50 and 200 units. Latency values are distributed between roughly 10 and 100 units, and CPU usage ranges between approximately 5 and 90 percent. These distributions help researchers understand how network characteristics vary across the dataset. Such analysis is useful for identifying feature patterns and detecting potential outliers before model training. Figure 4: Visualizing Key Feature Distributions using Histogram. 439 Figure 5 presents the evaluation results obtained after training the selected machine learning models. For anomaly detection classification, Naive Bayes achieved an accuracy of 95.40 percent, precision of 95.89 percent, recall of 95.40 percent, and F1 score of 95.49 percent. The KNN model achieved an accuracy of 82.40 percent with an F1 score of 83.23 percent, while the SVC model achieved an accuracy of 72.30 percent with an F1 score of 73.82 percent. In authentication failure classification, Naive Bayes achieved 100 percent accuracy, precision, recall, and F1 score. Figure 5: Model Performance Evaluation Interface after Training the models. Figure 6 shows the prediction results generated by the system after processing the provided network traffic data. The anomaly detection module predicts the network activity as normal with a confidence level of approximately 97.72 percent. In addition, the authentication failure classification module predicts level 9 with 100.00 percent confidence. These prediction results demonstrate the ability of the trained machine learning model to analyze network features and provide security related insights. Figure 6: Output of the Test Data. 5. CONCLUSION The research presents a robust Flask-based web application that seamlessly integrates machine learning for intelligent network security analysis. The system leverages a network dataset enriched with wavelet-derived attributes, particularly DWT_Feature_1, to strengthen anomaly detection and authentication failure classification. Multiple classifiers, including KNN, SVC, and NBC, are evaluated, with NBC achieving superior performance such as 95.40% accuracy, precision, recall, and F1-score for anomaly detection, and
PARAGRAPH B¶35-39
Fig. 5: Model Performance Comparison Interface for Training and Evaluation. Fig. 5 illustrates the model performance comparison interface used to train and evaluate machine learning algorithms within the system. The interface allows users to select algorithms such as KNN, SVC, and NB for training and evaluation. Through this component, users can initiate the model training process and compare the effectiveness of different classification techniques. The interface supports experimentation with multiple algorithms for anomaly detection and authentication failure classification. Fig. 6: Model Performance Evaluation Interface after Training the models. Fig. 6 presents the evaluation results obtained after training the selected machine learning models. For anomaly detection classification, Naive Bayes achieved an accuracy of 95.40 percent, precision of 95.89 percent, recall of 95.40 percent, and F1 score of 95.49 percent. The KNN model achieved an accuracy of 82.40 percent with an F1 score of 83.23 percent, while the SVC model achieved an accuracy of 72.30 percent with an F1 score of 73.82 percent. In authentication failure classification, Naive Bayes achieved 100 percent accuracy, precision, recall, and F1 score. Fig. 7 illustrates the prediction interface used for performing single input analysis in the network security application. The interface allows users to provide network traffic parameters including packet size, transmission rate, latency, protocol type, active connections, CPU usage, memory usage, bandwidth utilization, request response time, authentication failures, access violations, firewall blocks, IDS alerts, and DWT feature values. These input parameters are processed by the trained machine learning model to determine the security status of the network activity. The interface supports real time prediction of anomalous network behavior and authentication failure levels.
PARAGRAPH A¶32-36
Figure 4: Visualizing Key Feature Distributions using Histogram. 439 Figure 5 presents the evaluation results obtained after training the selected machine learning models. For anomaly detection classification, Naive Bayes achieved an accuracy of 95.40 percent, precision of 95.89 percent, recall of 95.40 percent, and F1 score of 95.49 percent. The KNN model achieved an accuracy of 82.40 percent with an F1 score of 83.23 percent, while the SVC model achieved an accuracy of 72.30 percent with an F1 score of 73.82 percent. In authentication failure classification, Naive Bayes achieved 100 percent accuracy, precision, recall, and F1 score. Figure 5: Model Performance Evaluation Interface after Training the models. Figure 6 shows the prediction results generated by the system after processing the provided network traffic data. The anomaly detection module predicts the network activity as normal with a confidence level of approximately 97.72 percent. In addition, the authentication failure classification module predicts level 9 with 100.00 percent confidence. These prediction results demonstrate the ability of the trained machine learning model to analyze network features and provide security related insights. Figure 6: Output of the Test Data. 5. CONCLUSION The research presents a robust Flask-based web application that seamlessly integrates machine learning for intelligent network security analysis. The system leverages a network dataset enriched with wavelet-derived attributes, particularly DWT_Feature_1, to strengthen anomaly detection and authentication failure classification. Multiple classifiers, including KNN, SVC, and NBC, are evaluated, with NBC achieving superior performance such as 95.40% accuracy, precision, recall, and F1-score for anomaly detection, and
PARAGRAPH B¶38-42
Fig. 7 illustrates the prediction interface used for performing single input analysis in the network security application. The interface allows users to provide network traffic parameters including packet size, transmission rate, latency, protocol type, active connections, CPU usage, memory usage, bandwidth utilization, request response time, authentication failures, access violations, firewall blocks, IDS alerts, and DWT feature values. These input parameters are processed by the trained machine learning model to determine the security status of the network activity. The interface supports real time prediction of anomalous network behavior and authentication failure levels. Fig. 7: Network Security Prediction Interface for Single Input Analysis. Fig. 8: Output of the Test Data. Fig. 8 shows the prediction results generated by the system after processing the provided network traffic data. The anomaly detection module predicts the network activity as normal with a confidence level of approximately 97.72 percent. In addition, the authentication failure classification module predicts level 9 with 100.00 percent confidence. These prediction results demonstrate the ability of the trained machine learning model to analyze network features and provide security related insights. 5. CONCLUSION The research presents a robust Flask-based web application that seamlessly integrates machine learning for intelligent network security analysis. The system leverages a network dataset enriched with waveletderived attributes, particularly DWT_Feature_1, to strengthen anomaly detection and authentication failure classification. Multiple classifiers, including KNN, SVC, and NBC, are evaluated, with NBC achieving superior performance such as 95.40% accuracy, precision, recall, and F1-score for anomaly detection, and a perfect 100% across all metrics for authentication failure classification. In contrast, KNN and SVC demonstrate comparatively lower performance, achieving 82.40% and 72.30% anomaly detection accuracy, and only 24.10% and 21.10% accuracy for authentication failure prediction. Performance optimization strategies include SMOTE-based class balancing to address dataset skew (1,354 anomalous vs. 3,646 normal samples), StandardScaler-driven feature normalization for stable
PARAGRAPH A¶33-37
439 Figure 5 presents the evaluation results obtained after training the selected machine learning models. For anomaly detection classification, Naive Bayes achieved an accuracy of 95.40 percent, precision of 95.89 percent, recall of 95.40 percent, and F1 score of 95.49 percent. The KNN model achieved an accuracy of 82.40 percent with an F1 score of 83.23 percent, while the SVC model achieved an accuracy of 72.30 percent with an F1 score of 73.82 percent. In authentication failure classification, Naive Bayes achieved 100 percent accuracy, precision, recall, and F1 score. Figure 5: Model Performance Evaluation Interface after Training the models. Figure 6 shows the prediction results generated by the system after processing the provided network traffic data. The anomaly detection module predicts the network activity as normal with a confidence level of approximately 97.72 percent. In addition, the authentication failure classification module predicts level 9 with 100.00 percent confidence. These prediction results demonstrate the ability of the trained machine learning model to analyze network features and provide security related insights. Figure 6: Output of the Test Data. 5. CONCLUSION The research presents a robust Flask-based web application that seamlessly integrates machine learning for intelligent network security analysis. The system leverages a network dataset enriched with wavelet-derived attributes, particularly DWT_Feature_1, to strengthen anomaly detection and authentication failure classification. Multiple classifiers, including KNN, SVC, and NBC, are evaluated, with NBC achieving superior performance such as 95.40% accuracy, precision, recall, and F1-score for anomaly detection, and a perfect 100% across all metrics for authentication failure classification. In contrast, KNN and SVC demonstrate comparatively lower performance, achieving 82.40% and 72.30% anomaly detection accuracy, and only 24.10% and 21.10% accuracy for authentication failure prediction. Performance optimization strategies include SMOTE-based class balancing to address dataset skew (1,354 anomalous vs. 3,646 normal samples), StandardScaler-driven feature normalization for stable learning, and joblib-based model persistence for efficient deployment. These enhancements collectively improve predictive reliability, computational efficiency, and real-time operational readiness of the intrusion detection framework.
PARAGRAPH B¶39-43
Fig. 7: Network Security Prediction Interface for Single Input Analysis. Fig. 8: Output of the Test Data. Fig. 8 shows the prediction results generated by the system after processing the provided network traffic data. The anomaly detection module predicts the network activity as normal with a confidence level of approximately 97.72 percent. In addition, the authentication failure classification module predicts level 9 with 100.00 percent confidence. These prediction results demonstrate the ability of the trained machine learning model to analyze network features and provide security related insights. 5. CONCLUSION The research presents a robust Flask-based web application that seamlessly integrates machine learning for intelligent network security analysis. The system leverages a network dataset enriched with waveletderived attributes, particularly DWT_Feature_1, to strengthen anomaly detection and authentication failure classification. Multiple classifiers, including KNN, SVC, and NBC, are evaluated, with NBC achieving superior performance such as 95.40% accuracy, precision, recall, and F1-score for anomaly detection, and a perfect 100% across all metrics for authentication failure classification. In contrast, KNN and SVC demonstrate comparatively lower performance, achieving 82.40% and 72.30% anomaly detection accuracy, and only 24.10% and 21.10% accuracy for authentication failure prediction. Performance optimization strategies include SMOTE-based class balancing to address dataset skew (1,354 anomalous vs. 3,646 normal samples), StandardScaler-driven feature normalization for stable learning, and joblib-based model persistence for efficient deployment. These enhancements collectively improve predictive reliability, computational efficiency, and real-time operational readiness of the intrusion detection framework.