cstub/ml-ids ? reverse-engineered prompt

Build me a machine learning based intrusion detection system that can tell whether network traffic looks benign or malicious.

I want it to use the CIC IDS 2018 dataset, train a binary classifier on network flow features, and let me run the full workflow from data prep to model training and evaluation. It should save the trained model and metrics in a way that makes it easy to compare results, and I’d like the notebook based workflow to stay clear and reproducible.

After that, please add a simple REST API that accepts pcap files, extracts flows, runs the model, and returns a clear result for each upload. If it makes sense, also add a basic web interface so someone can upload a capture and see the detection result without touching code.

Use the existing project structure, keep it practical, and if you need current library details, look them up online first.