V. Phan

Results show that strong performance on a public benchmark does not directly translate into operational effectiveness, and the current Hybrid-NIDS should be interpreted as a passive prototype and evaluation framework, and the reported experiments do not demonstrate that Suricata-Random Forest correlation provides better operational detection than Suricata alone.