Adaptive Machine Learning Based Network Intrusion Detection
Hatitye Chindove, Dane Brown
Abstract
Network intrusion detection system (NIDS) adoption is essential for mitigating computer network attacks in various scenarios. However, the increasing complexity of computer networks and attacks make it challenging to classify network traffic. Machine learning (ML) techniques in a NIDS can be affected by different scenarios, and thus the recency, size and applicability of datasets are vital factors to consider when selecting and tuning a machine learning classifier. The proposed approach evaluates relatively new datasets constructed such that they depict real-world scenarios. It includes analyses of dataset balancing and sampling, feature engineering and systematic ML-based NIDS model tuning focused on the adaptive improvement of intrusion detection. A comparison between machine learning classifiers forms part of the evaluation process. Results on the proposed approach model effectiveness for NIDS are discussed. Recurrent neural networks and random forests models consistently achieved high f1-score results with macro f1-scores of 0.73 and 0.87 for the CICIDS 2017 dataset; and 0.73 and 0.72 against the CICIDS 2018 dataset, respectively.