<![CDATA[Integrated network defense studies can produce misleading performance claims when packet captures, sensor logs, flow records, and ground-truth labels are not aligned to the same experimental interval. This study evaluates a decoupled network defense pipeline consisting of OPNsense as the gateway and firewall, Suricata as a passive network intrusion detection system, and offline Random Forest and XGBoost classifiers. Controlled benign HTTP, port-scanning, single-source TCP SYN-flood, SSH brute-force, and SQL-injection traffic was generated in a private GNS3–VMware testbed. Each run was accepted for detector evaluation only when its PCAP, EVE JSON, timing metadata, flow records, and checksum-verified evidence passed archive and temporal-overlap gates. Of 15 runs, 11 were complete and yielded 2,876 evaluable flows, including 368 benign and 2,508 attack-attributed flows. Suricata and Random Forest produced no positive detections. XGBoost and Hybrid-OR produced five true positives and no false positives, corresponding to 0.1994% recall and 0.3979% F1-score. All three SYN-flood runs lacked temporally overlapping EVE events and were excluded from complete-only detector metrics. The results demonstrate a traceable acquisition-to-evaluation pipeline but inadequate detection coverage under the evaluated configuration. They also show that synchronized evidence validation and training-to-deployment domain compatibility are essential before interpreting hybrid IDS performance.]]>
Copyrights © 2026
