Abstract:

Abstract: The massive increase in cyberattacks requires 

lightweight and smart intrusion detection systems (IDS) 

capable of real-time detecting both known and unknown 

attacks. In this paper we propose an architecture for H-

IDS that harmonize Deterministic Finite Automata (DFA) 

based rule matching with the ML and ANN classifiers for 

high detection accuracy. This approach works in four 

steps: stateful DFA, stateless DFA, XGBoost-based ML 

model, and ANN classifier. This layered architecture 

prevents the detection of an anomaly and recognition of a 

behavior pattern at an early stage. This model is 

implemented through Streamlit for real-time visualization 

and Plotly for cloud-based analytics. Experimental results 

show that the hybrid framework has high detection 

accuracy while maintaining computational efficiency, 

which is suitable for deployment in lightweight and real-

time monitoring environments.