A Survey of Random Forest Based Methods for Intrusion Detection Systems

Abstract

Over the past decades, researchers have been proposing different Intrusion Detection approaches to deal with the increasing number and complexity of threats for computer systems. In this context, Random Forest models have been providing a notable performance on their applications in the realm of the behaviour-based Intrusion Detection Systems. Specificities of the Random Forest model are used to provide classification, feature selection, and proximity metrics. This work provides a comprehensive review of the general basic concepts related to Intrusion Detection Systems, including taxonomies, attacks, data collection, modelling, evaluation metrics, and commonly used methods. It also provides a survey of Random Forest based methods applied in this context, considering the particularities involved in these models. Finally, some open questions and challenges are posed combined with possible directions to deal with them, which may guide future works on the area.

HTTP and contact‐based features for Botnet detection

“…This method provides a comparison metric, which is usually referred by Variable Importance Measure (VIM) or Permutation Importance Index (PIM). This approach is commonly used to create a variable importance rank for feature selection . In cases 6 and 7, we selected the top 30 most important features of the VIM rank.…”

“…Table 1 Random forest inherits, in some sense, the embedded feature selection of CART decision trees, which on each split evaluates the best feature to split according to a measure, such as Gini index or Residual Sum of Squares (RSS). 32 This method provides a comparison metric, which is usually referred by Variable Importance Measure (VIM) or Permutation Importance Index (PIM). This approach is commonly used to create a variable importance rank for feature selection.…”

“…This approach is commonly used to create a variable importance rank for feature selection. 32 In cases 6 and 7, we selected the top 30 most important features of the VIM rank.…”

“…We chose the random forest models because, as we note in Reference , in general, intrusion detection systems should generate low false positive rates and deal with: (1) a large amount of data for training and prediction; (2) imbalanced dataset (malicious data are supposed to be the minority part); (3) a large number of features; (4) categorical and continuous features. In this context, such models are suitable because they have the following advantages when compared with other commonly known machine learning methods: (1) low training time complexity, O ( nlog ( n )), and fast prediction; (2) resilience to deal with imbalanced datasets; (3) embedded feature selection method and intrinsic metric to rank features by importance; and (4) able to deal natively with categorical and continuous features.…”

Improving Intrusion Detection Model Prediction by Threshold Adaptation

“…The RF algorithm has many advantages, such as low training time complexity and fast prediction time [54,55], efficient handling of missing data, no required pre-processing (scaling or normalisation) of data, and efficient handling of imbalanced data and rare cases (due to the bootstrapping feature) [56]. However, this algorithm has some drawbacks, such as slow runtime as the number of its trees increase, and difficulty to interpret its models due to their high complexity (caused by randomisation) [57].…”