Abstract

With the rapid growth of computer networks and the increasing sophistication of cyberattacks, network intrusion detection systems (NIDS) have become a critical component of modern cybersecurity infrastructures. Among various detection approaches, rule-based intrusion detection systems remain relevant due to their interpretability, low computational overhead, and effectiveness in identifying known attack patterns. This paper presents a comprehensive study on rule-based network intrusion detection enhanced through statistical feature engineering techniques. The proposed approach focuses on extracting meaningful statistical characteristics from network traffic data, such as central tendency, dispersion, entropy, and temporal behavior, to improve the accuracy and robustness of rule-based detection mechanisms. Unlike purely signature-based systems that rely on static attack definitions, the integration of statistical features enables dynamic thresholding and context-aware rule evaluation. The paper discusses the architectural design of the detection framework, feature extraction processes, rule construction strategies, and evaluation metrics. Through analytical reasoning and experimental insights, the approach demonstrates improved detection performance for common network attacks including denial-of-service, probing, and unauthorized access attempts. The results indicate that statistical feature engineering significantly enhances detection precision while maintaining low false-positive rates. This work highlights the continued relevance of rule-based intrusion detection when combined with well-designed statistical analysis, offering a transparent, efficient, and scalable solution for securing modern network environments