Article Per Year (5 Year)
p-Index From 2021 - 2026
0.23
P-Index
This Author published in this journals
All Journal Bulletin of Network Engineer and Informatics (BUFNETS)
Rizky Rachman Judie Putra
Universitas Pendidikan Indonesia
Computer Science & IT

Published : 1 Documents Claim Missing Document
Claim Missing Document
Check
Articles

Found 1 Documents
Search

 1 
Evidence-Gated Evaluation of a Decoupled Firewall, Passive NIDS, and Offline Machine-Learning Pipeline in a Virtual Network Testbed Muhammad Rizki Revandi; Eddy Prasetyo Nugroho; Rizky Rachman Judie Putra
Bulletin of Network Engineer and Informatics Vol. 4 No. 2 (2026): BUFNETS (Bulletin of Network Engineer and Informatics) October 2026
Publisher : PT. GWEX NET PUBLISHER

Show Abstract | Download Original | Original Source | Check in Google Scholar | DOI: 10.59688/ajcqxn20

Abstract

Integrated network defense studies can produce misleading performance claims when packet captures, sensor logs, flow records, and ground-truth labels are not aligned to the same experimental interval. This study evaluates a decoupled network defense pipeline consisting of OPNsense as the gateway and firewall, Suricata as a passive network intrusion detection system, and offline Random Forest and XGBoost classifiers. Controlled benign HTTP, port-scanning, single-source TCP SYN-flood, SSH brute-force, and SQL-injection traffic was generated in a private GNS3–VMware testbed. Each run was accepted for detector evaluation only when its PCAP, EVE JSON, timing metadata, flow records, and checksum-verified evidence passed archive and temporal-overlap gates. Of 15 runs, 11 were complete and yielded 2,876 evaluable flows, including 368 benign and 2,508 attack-attributed flows. Suricata and Random Forest produced no positive detections. XGBoost and Hybrid-OR produced five true positives and no false positives, corresponding to 0.1994% recall and 0.3979% F1-score. All three SYN-flood runs lacked temporally overlapping EVE events and were excluded from complete-only detector metrics. The results demonstrate a traceable acquisition-to-evaluation pipeline but inadequate detection coverage under the evaluated configuration. They also show that synchronized evidence validation and training-to-deployment domain compatibility are essential before interpreting hybrid IDS performance.
Co-Authors Eddy Prasetyo Nugroho Muhammad Rizki Revandi