Maxmuthee/IDS-AFRICA-ML

Comparative study of Random Forest, XGBoost, and Neural Networks for network intrusion detection using CICIDS-2017. Includes SHAP explainability analysis and edge deployment feasibility assessment for resource-constrained networks in Sub-Saharan Africa. Target publication: IEEE Access. # IDS-Africa-ML ### Machine Learning-Based Intrusion Detection for Sub-Saharan African Networks #### A Comparative Study of ML Models with Explainability and Edge Deployment Analysis ## Overview This repository contains the full research pipeline for a comparative analysis of machine learning models applied to network intrusion detection, with a specific focus on deployment feasibility in Sub-Saharan African network environments. This work addresses a critical gap in existing literature: while ML-based Intrusion Detection Systems (IDS) have been extensively studied in high-resource settings, their applicability to the resource-constrained, infrastructure-limited networks common across Sub-Saharan Africa remains largely unexplored. **Research Domain:** Cybersecurity · Machine Learning · Network Security · African ICT --- ## Research Questions 1. How do Random Forest, XGBoost, and Neural Network models compare in detecting modern network intrusions on the CICIDS-2017 dataset? 2. How does class imbalance affect model performance, and can SMOTE-based resampling improve detection of minority attack types? 3. Which features most strongly drive intrusion detection decisions, and do they align with known network security principles? (SHAP analysis) 4. Which model offers the best trade-off between accuracy and computational cost for deployment in low-resource African network environments? --- ## Dataset **CICIDS-2017** — Canadian Institute for Cybersecurity Intrusion Detection Evaluation Dataset 2017 - **Source:** University of New Brunswick - **Size:** ~2.8 million network flow records - **Features:** 78 network traffic features - **Classes:** BENIGN + 14 attack categories including DDoS, PortScan, Botnet, Web Attacks, Infiltration - **Why CICIDS-2017:** Contains modern attack types not present in older benchmarks (e.g., NSL-KDD from 1999), making it significantly more relevant to current threat landscapes > Note: The dataset is not included in this repository due …