This deliverable presents the overall development status of the Machine Learning Intrusion Detection (MLID) component on M18 of the project’s lifetime and the end of the first interim of MLID’s two-staged development phases (M10-M18, M22-M30). This is a versioned document and describes the progress of the development of the first prototype of the component. Within the first development phase of MLID, feature exploration has been performed and a list of the most informative features (reflecting different aspects of users’ behaviour) has been identified. Three AI pipelines for intrusion detection have been designed, developed and evaluated in an extensive comparative analysis that includes multiple variants of each pipeline with numerous machine leaning (ML) and deep learning (DL) models.