Z-Shield: A Lightweight Hybrid Browser-Based Intrusion Detection Framework Using Hybrid Machine Learning

Client-side attacks such as cross-site scripting, SQL injection, and command-and-control traffic increasingly slip past server-centric defences because the browser itself is where the damage happens. This paper introduces Z-Shield, a real-time detection framework built as a Google Chrome extension and organised around a three-tier architecture. At its core is a hybrid engine: a supervised Random Forest handles known attack categories, while an unsupervised Isolation Forest watches for the zero-day cases no labelled dataset could have anticipated. We evaluate the system on the BCCC-CSE-CIC-IDS2018 dataset using five behavioural flow metrics: Flow Duration, Total Forward Packets, Total Backward Packets, Mean Packet Length, and Flow Inter-Arrival Time Mean. The supervised layer reaches 99.13% accuracy, 99.90% precision, 99.27% recall, and a 99.58% F1-score, and the unsupervised layer peaks at 97.09% isolation accuracy, ahead of the 93% benchmark reported by prior work. Importantly, the full pipeline resolves in under 100 milliseconds end-to-end, which keeps it usable for everyday browsing rather than just the lab.

Browser Extension, Hybrid Machine Learning, Isolation Forest, Random Forest, Web Security, Zero-Day Detection

1. R. Almuhanna and S. Dardouri, "A machine learning approach for anomaly based network intrusion detection," Frontiers in Artificial Intelligence, vol. 8, p. 1625891, 2025. https://doi.org/10.3389/frai.2025.1625891 [Google Scholar] [Crossref]

2. A. K. B. Arnob et al., "A comprehensive systematic review of intrusion detection systems," Journal of Edge Computing, vol. 4, no. 1, pp. 73-104, 2025. https://doi.org/10.55056/jec.885 [Google Scholar] [Crossref]

3. W. Chua et al., "Web traffic anomaly detection using isolation forest," Informatics, vol. 11, no. 4, p. 83, 2024. https://doi.org/10.3390/informatics11040083 [Google Scholar] [Crossref]

4. C. Djidjev, "siForest: Detecting network anomalies with set structured isolation forest," IEEE Trans. Network Science Eng., vol. 11, no. 2, pp. 292-305, 2024. https://arxiv.org/abs/2412.06015 [Google Scholar] [Crossref]

5. R. K. B. Holdbrook, A. Kwubeghari, and N. G. Ezeji, "An analysis of key tools for detecting cross site scripting attacks on web based systems," Lecture Notes ICST, vol. 54, pp. 187-202, 2024. https://www.researchgate.net/publication/377873080 [Google Scholar] [Crossref]

6. A. Hozouri, A. Mirzaei, and M. Effatparvar, "A comprehensive survey on intrusion detection systems with advances in machine learning," Discover Artificial Intelligence, vol. 5, p. 314, 2025. https://doi.org/10.1007/s44163-025-00578-1 [Google Scholar] [Crossref]

7. S. Sriram, V. Kumar, and T. Keerthivasan, "Advanced malware detecting Chrome extension using machine learning," Daffodil International University Archive, 2025. https://www.researchgate.net/publication/391218113 [Google Scholar] [Crossref]

8. I. H. Ji et al., "AI based anomaly detection over encrypted traffic: A systematic literature review," Sensors, vol. 24, no. 3, p. 898, 2024. https://doi.org/10.3390/s24030898 [Google Scholar] [Crossref]

9. Z. Okonkwo et al., "A graph representation framework for encrypted network traffic classification," Computers & Security, vol. 148, p. 104134, 2024. https://doi.org/10.1016/j.cose.2024.104134 [Google Scholar] [Crossref]

10. S. King et al., "PP3D: An in-browser vision-based defense against web behavior manipulation attacks," arXiv preprint, 2025. https://arxiv.org/abs/2510.18465 [Google Scholar] [Crossref]

11. M. Lakshmi et al., "Evaluating isolation forest for anomaly detection in SDN security," J. Electrical Systems, vol. 19, no. 4, pp. 279-297, 2023. https://www.researchgate.net/publication/387517103 [Google Scholar] [Crossref]

12. V. Z. Mohale and I. C. Obagbuwa, "Evaluating ML based intrusion detection systems: Enhancing transparency," Frontiers in Computer Science, vol. 7, p. 1520741, 2025. https://doi.org/10.3389/fcomp.2025.1520741 [Google Scholar] [Crossref]

13. A. Mohamed, "CSE-CIC-IDS2018 Dataset," Mendeley Data, V1, 2024. https://doi.org/10.17632/29hdbdzx2r.1 [Google Scholar] [Crossref]

14. H. Park et al., "Unsupervised ML methods for anomaly detection in network packets," Electronics, vol. 14, no. 14, p. 2779, 2025. https://doi.org/10.3390/electronics14142779 [Google Scholar] [Crossref]

15. D. Prasad et al., "Enhancing internet security: A ML based browser extension to prevent phishing attacks," 2024 Intl. Conf. on Communication, 2024. https://doi.org/10.1109/IC3SE62002.2024.10593201 [Google Scholar] [Crossref]

16. A. S. Kechedzhiev and O. L. Tsvetkova, "Anomaly detection research using isolation forest in machine learning," StudNet, vol. 3, no. 12, pp. 1460-1470, 2020. https://www.researchgate.net/publication/379984675 [Google Scholar] [Crossref]

• Assessment of the Role of Artificial Intelligence in Repositioning TVET for Economic Development in Nigeria
• Teachers’ Use of Assure Model Instructional Design on Learners’ Problem Solving Efficacy in Secondary Schools in Bungoma County, Kenya
• “E-Booksan Ang Kaalaman”: Development, Validation, and Utilization of Electronic Book in Academic Performance of Grade 9 Students in Social Studies
• Analyzing EFL University Students’ Academic Speaking Skills Through Self-Recorded Video Presentation
• Major Findings of The Study on Total Quality Management in Teachers’ Education Institutions (TEIs) In Assam – An Evaluative Study