Intrusion Detection System with Customized Machine Learning Techniques for NSL-KDD Dataset

Abstract

Modern networks are at risk from a variety of threats as a result of the enormous growth in internet-based traffic. By consuming time and resources, intrusive traffic hampers the efficient operation of network infrastructure. An effective strategy for preventing, detecting, and mitigating intrusion incidents will increase productivity. A crucial element of secure network traffic is Intrusion Detection System (IDS). An IDS system may be host-based or network-based to monitor intrusive network activity. Finding unusual internet traffic has become a severe security risk for intelligent devices. These systems are negatively impacted by several attacks, which are slowing computation. In addition, networked communication anomalies and breaches must be detected using Machine Learning (ML). This paper uses the NSL-KDD data set to propose a novel IDS based on Artificial Neural Networks (ANNs). As a result, the ML model generalizes sufficiently to perform well on untried data. The NSL-KDD dataset shall be utilized for both training and testing. In this paper, we present a custom ANN model architecture using the Keras open-source software package. The specific arrangement of nodes and layers, along with the activation functions, enhances the model's ability to capture intricate patterns in network data. The performance of the ANN is carefully tested and evaluated, resulting in the identification of a maximum detection accuracy of 97.5%. We thoroughly compared our suggested model to industry-recognized benchmark methods, such as decision classifier combinations and ML classifiers like k-Nearest Neighbors (KNN), Deep Learning (DL), Support Vector Machine (SVM), Long Short-Term Memory (LSTM), Deep Neural Network (DNN), and ANN. It is encouraging to see that our model consistently outperformed each of these tried-and-true techniques in all evaluations. This result underlines the effectiveness of the suggested methodology by demonstrating the ANN's capacity to accurately assess the effectiveness of the developed strategy in identifying and categorizing instances of network intrusion.

CNN Channel Attention Intrusion Detection System Using NSL-KDD Dataset

“…Although it lacks recall data, reference [23] displays unbalanced results with respectable precision and F1-score. Although reference [27] obtains excellent ratings, our proposed model performs better, especially when it comes to precision. Our model is preferable because it can attain high accuracy with similarly excellent precision, recall, and F1-score.…”

“…In addition, Zakariah et al [27] added cybersecurity expertise by examining an intrusion detection system (IDS) using tailored machine learning techniques on the NSL-KDD dataset. Based on the dataset, this study employs 22,544 testing samples and 125,973 training samples (KDDTrain+).…”

“…To update and streamline the data, the University of New Brunswick produced the NSL-KDD dataset [7,13,20,27]. Moreover, KDDTrain+_20Percent helps train and validate models with 20% of the training dataset.…”

“…Binary features (7,12,14,20,21,22) describe attributes with two states, while categorical features (2, 3, 4, 42) reflect qualitative variables with distinct categories. Discrete features (8,9,15,(23)(24)(25)(26)(27)(28)(29)(30)(31)(32)(33)(34)(35)(36)(37)(38)(39)(40)(41)43) are unique numeric variables, but continuous features (1,5,6,10,11,13,16,17,18,19) can take any real value within a range. The dataset's 'attack' label has 40 labels, categorizing attacks as revised, U2R, DoS, R2L, and probing.…”

“…Nevertheless, they have challenges discerning unfamiliar malware attacks that have not been previously encountered, mostly due to the absence of a pre-existing template for comparison. Conversely, anomaly-based IDS bypasses this limitation by employing machine learning to construct a reliable model of network behavior [27][28][29]. The incoming data is subsequently compared to this model, and any departures from the expected behavior are detected as suspicious.…”