Intrusion Detection: A Comparison Study of Machine Learning Models Using Unbalanced Dataset

Abstract

The worldwide process of converting most activities of both corporate and non-corporate entities into digital formats is now firmly established. Machine learning models are necessary to serve as a tool for preventing illegal intrusion onto different networks. The machine learning (ML) model's strengths and drawbacks pertain to intrusion detection (IDS) tasks. This study used an experimental methodology to assess the efficacy of various ML models, including linear SVC, LR, random forest (RF), decision tree (DT), and XGBoost, in detecting intrusion on the UNSW NB15 datasets. The objective is to compare the strengths and shortcomings of these models. Data exploration, Feature engineering, selection and a test set of 15%, a validation set of 15%, and a training set of 70% respectively were used for data splitting. Performance evaluation was carried out using accuracy, recall, precision F1-score and confusion matrix plotted. The outcome of the experiment shows a percentage of 92.71% (1, normal) and 7.29% (0, attack) for normal traffic and attack traffic respectively. Performance evaluation results showed that RF and XGBoost outperformed the other ML models. Hence, ML models can effectively be used to detect system attacks. We intend to expand this research in the future and use the paradigm in a real-world setting with further conclusions and justifications.