Machine learning-based intrusion detection framework for digital forensic readiness.
No Thumbnail Available
Date
2026-09
Authors
Journal Title
Journal ISSN
Volume Title
Publisher
Busitema University
Abstract
University networks face a structural security challenge: machine learning-based intrusion detection systems apply strict data minimisation, discarding non-alert data to preserve throughput, whilst digital forensic readiness demands comprehensive retention of all digital artefacts, enriched with metadata, secured cryptographically, and managed under a documented chain of custody. No existing framework has resolved this incompatibility within a single architecture.
This study designed and validated a machine learning-based intrusion detection framework for digital forensic readiness that resolves this tension through an asynchronous forensic artefact capture layer operating in parallel with the detection pipeline. The framework employs two well-established machine learning classifiers that have been extensively applied to benchmark intrusion detection datasets by multiple independent research teams prior to this study: Random Forest, which has been widely used on the UNSW-NB15 dataset and achieved 99.67% accuracy and F1-score in this study, and Long Short-Term Memory (LSTM), which has been widely used on the NSL-KDD dataset and achieved 97.43% accuracy and F1-score in this study. No novelty is claimed in the choice of algorithm or dataset. The contribution of this study is the architectural framework that integrates these established classifiers with embedded forensic readiness mechanisms, and the empirical demonstration that detection performance is not compromised when forensic logging is introduced as an embedded architectural layer.
Design Science Research methodology guided the study. Validation employed empirical machine learning evaluation, architectural consistency analysis against twelve formally specified requirements, and scenario-based evaluation across three operational scenarios. All twelve requirements were satisfied. Key quantitative metrics include a detection-to-logging latency of 8.3 milliseconds, storage overhead of 4.7 kilobytes per event, evidence retrieval time of 1.2 seconds, and 100 per cent completeness and integrity rates across all scenarios.
To the knowledge of the authors, based on the literature reviewed in this study, the framework is the first formally specified architecture to simultaneously address machine learning-based intrusion detection with concretely specified and empirically eval machine learning-based intrusion detection with concretely specified and empirically evaluated classifiers, pre-incident forensic readiness, and evidence integrity management within a single unified architectural specification.
Keywords: intrusion detection systems; digital forensic readiness; machine learning; Random Forest; LSTM; UNSW-NB15; NSL-KDD; Design Science Research; evidence integrity; chain of custody; university networks
Description
Dissertation
Keywords
Citation
Isabirye, A. (2026). Machine learning-based intrusion detection framework for digital forensic readiness. [Unpublished dissertation]. Busitema University.