Ensemble Classifiers for Network Intrusion Detection Using a Novel Network Attack Dataset

Abstract

Due to the extensive use of computer networks, new risks have arisen, and improving the speed and accuracy of security mechanisms has become a critical need. Although new security tools have been developed, the fast growth of malicious activities continues to be a pressing issue that creates severe threats to network security. Classical security tools such as firewalls are used as a first-line defense against security problems. However, firewalls do not entirely or perfectly eliminate intrusions. Thus, network administrators rely heavily on intrusion detection systems (IDSs) to detect such network intrusion activities. Machine learning (ML) is a practical approach to intrusion detection that, based on data, learns how to differentiate between abnormal and regular traffic. This paper provides a comprehensive analysis of some existing ML classifiers for identifying intrusions in network traffic. It also produces a new reliable dataset called GTCS (Game Theory and Cyber Security) that matches real-world criteria and can be used to assess the performance of the ML classifiers in a detailed experimental evaluation. Finally, the paper proposes an ensemble and adaptive classifier model composed of multiple classifiers with different learning paradigms to address the issue of the accuracy and false alarm rate in IDSs. Our classifiers show high precision and recall rates and use a comprehensive set of features compared to previous work.

Feature Selection and Ensemble-Based Intrusion Detection System: An Efficient and Comprehensive Approach

“…Ensemble learning is a rapidly rising innovative machine learning technique that utilizes multiple weak learners to yield a higher predictive classifier than single machine learning models for a given problem. The primary objective of ensemble learning is to improve the detection accuracy and lower the false alarm rates of predictive classifiers by combining the strengths and capabilities of various weak learners to achieve a robust, efficient, and effective classifier [6,15,28]. Moreover, ensemble methods seek to create a set of hypotheses or learners and combine them to solve a given problem compared to conventional machine learning techniques, attempting to learn a single hypothesis from the training data [29].…”

“…Therefore, different weak learners are employed to identify diverse kinds of attacks. However, the significant problem with ensemble approaches is choosing the correct way to integrate suitable individual classifiers and the decision function to combine the selected algorithms' outcomes [28]. The three most popular combination schemes of ensemble learning are bagging, boosting, stacking in the form of weighted averaging for regression, and majority voting for classification problems [30].…”

“…The exponential evolution of the innovative Internet applications and related technologies has led to the substantial accumulation of unbalanced and high dimensional data at a high velocity, significantly challenging traditional machine learning approaches [37]. As a result, feature selection over the last decade has been practically and theoretically demonstrated to be very effective in processing unbalanced and high dimensional data of various research domains, especially in IDSs [15,28,33,38], thereby leading to improved performance of IDSs classifiers [29].…”

“…Furthermore, the authors of [28] produced a novel trustworthy dataset named Game Theory and Cyber Security (GTCS) with 83 attributes and a labeled class of normal or attack that helps to mitigate the current IDS dataset challenges and simulate negligible attacks like botnet, infiltration, DDoS, and brute force. The authors use the InfoGainAttributeEval algorithm with Ranker to simply the novel dataset, then evaluated it with an enhanced ensemble based on multiple classifiers with different Hyperparameter optimization to address the current accuracy and FAR challenges.…”

Triple Modular Redundancy Optimization for Threshold Determination in Intrusion Detection Systems

“…In [22], an analysis of existing machine learning algorithms has been presented together with new a GTCS dataset. In addition, the new adaptive classifier model has been presented that is assembled from different learning models in order to improve the accuracy and false positive rates of DDoS attacks.…”