Balanced Multi-Class Network Intrusion Detection Using Machine Learning

被引:2
作者
Khan, Faraz Ahmad [1 ]
Shah, Asghar Ali [2 ]
Alshammry, Nizal [3 ]
Saif, Saifullah [1 ]
Khan, Wasim [1 ]
Malik, Muhammad Osama [4 ]
Ullah, Zahid [5 ]
机构
[1] Univ Engn & Technol Mardan, Mardan 23200, Pakistan
[2] Beaconhouse Int Coll, Dept Comp Sci, Islamabad 46000, Pakistan
[3] Northern Border Univ, Fac Comp & Informat Technol, Dept Comp Sci, Ar Ar 91431, Saudi Arabia
[4] Univ Tulsa, Collin Coll Business, Tulsa, OK 74104 USA
[5] Politecn Milan, Dipartimento Elettron Informaz & Bioingn, I-20133 Milan, Italy
来源
IEEE ACCESS | 2024年 / 12卷
关键词
Accuracy; Random forests; Classification algorithms; Telecommunication traffic; Security; Organizations; Feature extraction; Machine learning algorithms; Firewalls (computing); Biological system modeling; AdaBoost; anomaly detection; binary classification; decision trees; deep learning; intrusion detection; K-nearest neighbor (KNN); logistic regression; machine learning; naive Bayes classifiers; network security; random forests;
D O I
10.1109/ACCESS.2024.3503497
中图分类号
TP [自动化技术、计算机技术];
学科分类号
0812 ;
摘要
Cybersecurity is gaining a high position in the IT sector. Connecting more devices to the internet smooths the way for hackers. It is hard for signature-based security tools to detect new attacks that emerge and evolve with slight changes. Researchers are trying to build a Network Intrusion Detection System (NIDS) that can accurately detect the zero-day attacks evolved through minor changes. An anomaly-based NIDS has attracted researchers to develop a system to detect malign traffic in a network using Machine Learning (ML) models. Therefore, in recent years, the designs of modern NIDS for higher detection rates and lower false alarms have been refined by utilizing advanced ML and Deep Learning (DL) approaches. However, it is still a problem for the supervised and unsupervised algorithms to achieve high performance, absolute accuracy, and minimal false alarm rate. This work aims to design an effective NIDS that addresses the current limitation using machine learning models trained on reliable flow-based data (CICIDS-2017). The system will improve the detection accuracy and reduce false alarms in high-speed network environments. To achieve results, the dataset has been balanced using the SMOTE-Tomek Links technique. After cleaning and organizing the dataset, the trained algorithms are Decision Tree, Random Forest, XGBoost, K-Nearest Neighbor, Naive Bayes, Logistic Regression, and AdaBoost algorithm. These algorithms are pulled from literature studies because of their exceptional performance on old datasets. This work has achieved a Decision Tree model with 96.37% accuracy and 96.33% F1-score and the AdaBoost model with 96.37% accuracy and 96.33% F1-score for multiclass classification. For binary classification, the Decision Tree (DT) model has exhibited the highest test accuracy of 99.96%, followed by Random Forest (99.84%), Adaboost (99.77%), and Xgboost (99.57), with the highest average precision of 100% and ROC-AUC of 99.96%. We have also found that binary classification performs better when it takes more time to train each classifier than multiclass classification. This research study incorporates proper validation of the models and achieves high accuracy and exact results compared to the literature. The results show that a balanced CICIDS-2017 dataset improves the performance of decision trees and AdaBoost classifiers. The emplacement of NIDS in networks and their underlying technology are equally significant for detecting real-time attacks.
引用
收藏
页码:178222 / 178236
页数:15
相关论文
共 50 条
[21]   Review on Network Intrusion Detection Techniques using Machine Learning [J].
Shashank, K. ;
Balachandra, Mamatha .
PROCEEDINGS OF 2018 IEEE DISTRIBUTED COMPUTING, VLSI, ELECTRICAL CIRCUITS AND ROBOTICS (DISCOVER), 2018, :104-109
[22]   An Explainable Machine Learning Framework for Intrusion Detection Systems [J].
Wang, Maonan ;
Zheng, Kangfeng ;
Yang, Yanqing ;
Wang, Xiujuan .
IEEE ACCESS, 2020, 8 :73127-73141
[23]   Machine Learning for Misuse-Based Network Intrusion Detection: Overview, Unified Evaluation and Feature Choice Comparison Framework [J].
Le Jeune, Laurens ;
Goedeme, Toon ;
Mentens, Nele .
IEEE ACCESS, 2021, 9 :63995-64015
[24]   Cascaded Multi-Class Network Intrusion Detection With Decision Tree and Self-attentive Model [J].
Lan, Yuchen ;
Truong-Huu, Tram ;
Wu, Jiyan ;
Teo, Sin G. .
2022 IEEE INTERNATIONAL CONFERENCE ON DATA MINING WORKSHOPS, ICDMW, 2022, :586-592
[25]   Automated Multi-Class Seizure-Type Classification System Using EEG Signals and Machine Learning Algorithms [J].
Abirami, S. ;
Kathiravan, M. ;
Yuvaraj, Rajamanickam ;
Menon, Ramshekhar N. ;
Thomas, John ;
Karthick, P. A. ;
Prince, A. Amalin ;
Ronickom, Jac Fredo Agastinose .
IEEE ACCESS, 2024, 12 :136524-136541
[26]   A LSTM-FCNN based multi-class intrusion detection using scalable framework [J].
Sahu, Santosh Kumar ;
Mohapatra, Durga Prasad ;
Rout, Jitendra Kumar ;
Sahoo, Kshira Sagar ;
Quoc-Viet Pham ;
Nhu-Ngoc Dao .
COMPUTERS & ELECTRICAL ENGINEERING, 2022, 99
[27]   SLX:A Multi-class Network Intrusion Detection Method on Stacking Boosting Algorithm [J].
Liu, Zhitong ;
Zhang, Zhiqiang ;
Cheng, Mengqing ;
Tan, Haonan ;
Tan, Xinyao ;
Wang, Le .
2024 IEEE 9TH INTERNATIONAL CONFERENCE ON DATA SCIENCE IN CYBERSPACE, DSC, 2024, :116-121
[28]   Lightweight Federated Learning for Efficient Network Intrusion Detection [J].
Bouayad, Abdelhak ;
Alami, Hamza ;
Idrissi, Meryem Janati ;
Berrada, Ismail .
IEEE ACCESS, 2024, 12 :172027-172045
[29]   Network Intrusion Detection using Hybrid Machine Learning [J].
Chuang, Po-Jen ;
Li, Si-Han .
2019 INTERNATIONAL CONFERENCE ON FUZZY THEORY AND ITS APPLICATIONS (IFUZZY), 2019, :289-293
[30]   Research on Network Intrusion Detection Technology Based on Machine Learning [J].
Wu, Fei ;
Li, Ting ;
Wu, Zhen ;
Wu, ShuLin ;
Xiao, ChuanQi .
INTERNATIONAL JOURNAL OF WIRELESS INFORMATION NETWORKS, 2021, 28 (03) :262-275