A hybrid machine learning method for increasing the performance of network intrusion detection systems

Abstract

The internet has grown enormously for many years. It is not just connecting computer networks but also a group of devices worldwide involving big data. The internet provides an opportunity to make various innovations for any sector, such as education, health, public facility, financial technology, and digital commerce. Despite its advantages, the internet may contain dangerous activities and cyber-attacks that may happen to anyone connected through the internet. To detect any cyber-attack intrudes on the network system, an intrusion detection system (IDS) is applied, which can identify those incoming attacks. The intrusion detection system works in two mechanisms: signature-based detection and anomaly-based detection. In anomaly-based detection, the quality of the machine learning model obtained is influenced by the data training process. The biggest challenge of machine learning methods is how to build an appropriate model to represent the dataset. This research proposes a hybrid machine learning method by combining the feature selection method, representing the supervised learning and data reduction method as the unsupervised learning to build an appropriate model. It works by selecting relevant and significant features using feature importance decision tree-based method with recursive feature elimination and detecting anomaly/outlier data using the Local Outlier Factor (LOF) method. The experimental results show that the proposed method achieves the highest accuracy in detecting R2L (i.e., 99.89%) and keeps higher for other attack types than most other research in the NSL-KDD dataset. Therefore, it has a more stable performance than the others. More challenges are experienced in the UNSW-NB15 dataset with binary classes.

Composition of Hybrid Deep Learning Model and Feature Optimization for Intrusion Detection System

“…The accuracy graph is also shown in Figure 12 . The CNN–GRU model manages to score a better accuracy rate than models developed by Samson H. et al, 2020 [ 15 ] and Sun P. et al, 2020 [ 17 ]. The other two CNN models (Priyanka V. et al, 2021 [ 20 ] and Maseer Z. et al, 2021 [ 33 ]) have slightly higher accuracy scores than our proposed technique.…”

“…Achmad et al [ 15 ] demonstrated a hybrid strategy that incorporates the feature optimization method, which stands for supervised method, and the data reduction method, which stands for unsupervised method. Attribute importance DT-based technique with recursive feature removal is used to pick pertinent and important attributes, and the LOF method is used to identify anomalous or outlier data.…”

An Ensemble Learning Voting Technique for Network Intrusion Detection Systems

“…Among them, the Decision Tree classifier is more effective than other classifiers, with accuracy rates of 99%-100%. Megantara and Ahmad [18] proposed a hybrid machine learning method that combines feature selection methods, and represents supervised learning and data reduction methods as unsupervised learning. The results show that this method can improve accuracy and reduce time, but it needs further optimization in biased, imbalanced and abnormal data.…”

Enhancing the Intrusion Detection Efficiency using a Partitioning-based Recursive Feature Elimination in Big Cloud Environment

“…The supervised machine learning (SML) model is used when the data available for the training phase is labelled, which means that some dataset attributes contain the correct answer that will be used at the end of the learning process to evaluate the final outputs. This model can be developed using either classification or regression algorithms [4], [5]. When dealing with a dataset that lacks labelled features, the unsupervised machine learning (UML) model is used and relied on; the model instead relies on trial and error to evaluate the learning process's outcomes.…”