Anomaly-Based Intrusion Detection Using Machine Learning

R Lalduhsaka, Nilutpol Bora, Ajoy Kumar Khan

2022International Journal of Information Security and Privacy16 citationsDOI

Abstract

Intrusion detection systems were developed to detect any suspicious traffic in the network. Conventional intrusion detection comes with its sets of limitations. The authors aimed to improve anomaly-based intrusion detection using an ensemble approach of machine learning. In this article, CICIDS2017 and CICIDS 2018 datasets have been used for implementing the proposed method. Random forest regressor is used for feature selection. Three machine learning algorithms (i.e., naïve bayes, QDA, and ID3) are selected and combined (ensembled) for their low computational cost. The ensemble algorithm results are compared with the standalone algorithms. With the ensembled method, classification accuracy of 98.3% and 95.1%, with FAR of 2% and 6.9% were achieved on CICIDS 2017 and CICIDS 2018 datasets respectively. Naïve bayes, QDA, and ID3 have classification accuracies of 82%, 84.7%, and 95.8% respectively on CICIDS 2017; 68.3%, 68.4%, and 94.4% respectively on CICIDS 2018; false alarm rates of 54.9%, 55.5%, and 20.6% respectively on CICIDS 2017; and 3.6%, 3.7%, and 7.1% respectively on CICIDS 2018.

Topics & Concepts

Computer scienceNaive Bayes classifierIntrusion detection systemRandom forestArtificial intelligenceMachine learningAnomaly detectionEnsemble learningFeature selectionID3Constant false alarm rateDecision treeData miningPattern recognition (psychology)Support vector machineDecision tree learningNetwork Security and Intrusion DetectionInternet Traffic Analysis and Secure E-votingAdvanced Malware Detection Techniques