Hybrid Ids/Ips System for Enterprise Networks: Design, Implementation, and Empirical Evaluation on Real Intrusion Data

Enterprise networks face increasingly advanced cyberattacks that traditional single-purpose security tools struggle to handle: Intrusion Detection Systems (IDS) can identify suspicious activity but cannot act on it, while Intrusion Prevention Systems (IPS) can block threats automatically but sometimes disrupt legitimate traffic. This paper proposes a Hybrid IDS/IPS architecture that fuses a signature-matching engine, a machine-learning-based anomaly engine (Random Forest), and a threshold-based decision engine that chooses between allowing, logging, or actively blocking traffic. Unlike a purely conceptual design, the proposed architecture was implemented in Python and empirically evaluated on the NSL-KDD benchmark intrusion dataset (125,973 training and 22,544 test records), using the standard KDDTest+ evaluation protocol in which the test set deliberately contains 17 attack types never seen during training — a realistic proxy for zero-day-style attacks. The hybrid engine achieved 79.22% accuracy, 96.83% precision, 65.65% recall, an F1-score of 78.25%, a false-positive rate of 2.84%, and a ROC-AUC of 0.9661, outperforming both a standalone signature-only detector (70.01% accuracy, 47.60% recall) and the standalone machine-learning engine alone (77.72% accuracy) on every metric except FPR, where it matched the ML engine. A second experiment, evaluating the same Random Forest model on an in-distribution 80/20 split of the same dataset (i.e., without held-out unseen attack types), reached 99.90% accuracy — a gap of over 20 percentage points that is not a modelling error but a demonstration of how strongly the choice of evaluation protocol affects reported IDS performance, and a caution the field should apply when comparing accuracy figures across papers. The paper closes with an honest discussion of the prototype's limitations (a single benchmark dataset, a simplified flow-feature signature simulation rather than deep packet inspection, and no live-traffic or energy measurement) and outlines concrete future work toward a production-grade, cloud-native, Zero-Trust-integrated hybrid defense system.