Machine Learning Algorithms for Raw and Unbalanced Intrusion Detection Data in a Multi-Class Classification Problem

Abstract

Various machine learning algorithms have been applied to network intrusion classification problems, including both binary and multi-class classifications. Despite the existence of numerous studies involving unbalanced network intrusion datasets, such as CIC-IDS2017, a prevalent approach is to address the issue by either merging the classes to optimize their numbers or retaining only the most dominant ones. However, there is no consistent trend showing that accuracy always decreases as the number of classes increases. Furthermore, it is essential for cybersecurity practitioners to recognize the specific type of attack and comprehend the causal factors that contribute to the resulting outcomes. This study focuses on tackling the challenges associated with evaluating the performance of multi-class classification for network intrusions using highly imbalanced raw data that encompasses the CIC-IDS2017 and CSE-CIC-IDS2018 datasets. The research concentrates on investigating diverse machine learning (ML) models, including Logistic Regression, Random Forest, Decision Trees, CNNs, and Artificial Neural Networks. Additionally, it explores the utilization of explainable AI (XAI) methods to interpret the obtained results. The results obtained indicated that decision trees using the CART algorithm performed best on the 28-class classification task, with an average macro F1-score of 0.96878.

A Novel IDS with a Dynamic Access Control Algorithm to Detect and Defend Intrusion at IoT Nodes

“…However, it suffers from the same limitation of false alarm rate and detection rate optimization. Similar weaknesses are noticeable in the papers of A. Fatani et al [15], M. Bacevicius et al [16], and H. Alshahrani et al [17]. This paper presents a unique approach to discovering the balance between intrusion detection and false positive rates.…”

From Bytes to Insights: A Systematic Literature Review on Unraveling IDS Datasets for Enhanced Cybersecurity Understanding

“…IoT-Based Network Intrusion Detection Systems ((References: [54,58,62,63,64,65,66,67,68,69,99,100,101]) Disparate Membership Inference Attacks (Reference: [35]) Analysis of Open Source Datasets for IDS (Reference: [23,27]) Hybrid Deep Learning Model for IDS (Reference: [32]) Smart Home Anomaly-Based IDS ( Reference: [36]) The research articles meticulously examined in this study have been judiciously classified according to their quartile rankings, providing invaluable insights into the academic influence and eminence of these esteemed publications. The quartile categorization, elegantly portrayed in Fig.…”

“…The essay successfully highlights the need to handle the dataset difficulties in anomaly detection as a whole, however it might be strengthened by elaborating on several points. This research paper [23] presents a comprehensive examination of the categorization of IDS with regards to their architecture, detection techniques, decision-making processes, and localization. This research covers a range of IDS methods that are based on ML techniques.…”

Comparison between Machine Learning and Physical Models Applied to the Evaluation of Co-Seismic Landslide Hazard

“…Among the wide variety of ANNs, feed-forward networks were used in this study, particularly following a model-averaged neural network (avNNet) [58,59]. The idea be-hind avNNet is to train multiple neural network models with different configurations or initializations, and then average their predictions to obtain a more robust and accurate final prediction.…”