Intrusion Detection Using Codon Encoding and K-mer Modeling with Machine Learning

Abstract

     As cyberattacks become more complex and frequent, Intrusion Detection Systems (IDS) should evolve to be effective in detecting known and unknown threats. In this paper, a new anomaly-based IDS model that uses amino acid codon encoding inspired by biology, k-mer extraction and supervised machine learning is proposed. Unlike traditional IDS feature extraction techniques, which are based on statistical or flow-based numeric features, codon-based encryption offers a symbolic and biologically motivated representation that maintains sequential relationships and semantic connections between network events. This allows the model to respond to complex attacks better, gain noise resistance, and also generalize to invisible attacks. The suggested approach converts network traffic records of TII-SSRC-23 dataset into symbolic sequences of amino acids via codon translation. These sequences are divided into sequences of fixed length k-mers, and the frequency of these k-mers is used as input to three classification algorithms, namely Random Forest, Support Vector Machine (SVM) and Naive Bayes. Experiments on the TII-SSRC-23 dataset demonstrate that the Random Forest classifier achieved superior performance among the tested other classifier algorithms, having a detection rate of 98.42%, false alarm rate of 4.9%, and accuracy of 96.87%, surpassing SVM and Naive Bayes. The robustness and generalization of the framework are confirmed by the detailed analysis of the detection rates provided on 18 different types of malicious attacks. The results validate the effectiveness of codon-based sequence encoding and machine learning in advancing intrusion detection systems.