隨著網路科技的驚人進步和遠距工作模式的日漸主流化，網路安全已顯然崛起為當今社會的最為緊急且關鍵的問題之一。在此情況下，也因為工作數位環境的多樣化且便利性，使得網路攻擊的手法以越來越複雜的方式進行，特別是隨著勒索軟體的驚人增長，對各種企業和組織的資訊安全構成了巨大的威脅。為了有效應對這種挑戰，入侵偵測系統（Intrusion-detection system，IDS）作為網路安全的基石，其角色變得越來越關鍵。然而，現行的入侵偵測技術仍然面臨著一些明顯的侷限性，如對於未知攻擊的辨識能力不足、對攻擊發生時間的預測困難等。 本研究的目標是開發一個基於機器學習的新型網路入侵偵測系統，此系統能進行即時警報，並提前預測可能的網路攻擊，以實現資訊安全的早期防禦。在這一過程中，我們首先進行了資料的時間序列性評估，並發現我們的特徵變數不適合應用於時間序列模型。接著，我們將下一次攻擊發生的時間由數值型轉換為類別型，並進一步將其細分為四種不同的緊急程度。我們運用了七種不同的分類模型進行預測，並利用XGBoost算法進行特徵選取。最終，我們透過交叉驗證的方式提高模型的準確率。經過實驗驗證，我們的系統在預測下一次攻擊發生時間的準確性上達到了74.82%，並在實際運用中有效地提升了企業的網路安全防禦能力。;As the astonishing advancement of internet technology and the mainstreaming of remote work modes, cybersecurity has emerged as one of the most urgent and critical issues in today′s society. In this context, the tactics of cyber-attacks are proceeding in increasingly complex ways, particularly with the astonishing growth of ransomware, posing a huge threat to the information security of various businesses and organizations. To effectively confront this challenge, the Intrusion-detection system (IDS) as the cornerstone of cybersecurity, its role is becoming increasingly crucial. However, the current intrusion detection technologies still face some apparent limitations, such as insufficient recognition ability for unknown attacks and difficulty in predicting the occurrence time of attacks. The goal of this study is to develop a new intrusion detection system based on machine learning, which can issue real-time alerts and predict potential network attacks in advance to achieve early defense of information security. In this process, we first conducted a time series assessment of the data and found that our feature variables are not suitable for application to the time series model. Then, we converted the time of the next attack from a numeric type to a categorical type, and further subdivided it into four different levels of urgency. We used seven different classification models for prediction and used the XGBoost algorithm for feature selection. Finally, we improved the accuracy of the model through cross-validation. After experimental verification, our system achieved 74.82% accuracy in predicting the time of the next attack, and effectively enhanced the cybersecurity defense capabilities of enterprises in practical applications.
