Network Intrusion Detection and Comparative Analysis Using Ensemble Machine Learning and Feature Selection

Das, Saikat; Saha, Sajal; Priyoti, Annita Tahsin; Roy, Etee Kawna; Sheldon, Frederick T.; Haque, Anwar; Shiva, Sajjan G.

doi:10.1109/tnsm.2021.3138457

Cited by 45 publications

(12 citation statements)

References 32 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…We compared the performance of our models with those of existing models in the literature, as presented in Table 9 . In the work of Das et al [ 11 ], the proposed model achieved an accuracy of 92% for the ensemble decision tree, and our En_DT achieved 97.8%, which is about a 5.8% improvement. In addition, while the ensemble based on the neural network (NN), a deep learning model, achieved 99.5%, our BoostedEnsML achieved 100% in all evaluation metrics, showing that the proposed approach is better.…”

Section: Results and Discussionmentioning

confidence: 71%

See 1 more Smart Citation

BoostedEnML: Efficient Technique for Detecting Cyberattacks in IoT Systems Using Boosted Ensemble Machine Learning

Okey

Maidin

Adasme

et al. 2022

Sensors

View full text Add to dashboard Cite

Following the recent advances in wireless communication leading to increased Internet of Things (IoT) systems, many security threats are currently ravaging IoT systems, causing harm to information. Considering the vast application areas of IoT systems, ensuring that cyberattacks are holistically detected to avoid harm is paramount. Machine learning (ML) algorithms have demonstrated high capacity in helping to mitigate attacks on IoT devices and other edge systems with reasonable accuracy. However, the dynamics of operation of intruders in IoT networks require more improved IDS models capable of detecting multiple attacks with a higher detection rate and lower computational resource requirement, which is one of the challenges of IoT systems. Many ensemble methods have been used with different ML classifiers, including decision trees and random forests, to propose IDS models for IoT environments. The boosting method is one of the approaches used to design an ensemble classifier. This paper proposes an efficient method for detecting cyberattacks and network intrusions based on boosted ML classifiers. Our proposed model is named BoostedEnML. First, we train six different ML classifiers (DT, RF, ET, LGBM, AD, and XGB) and obtain an ensemble using the stacking method and another with a majority voting approach. Two different datasets containing high-profile attacks, including distributed denial of service (DDoS), denial of service (DoS), botnets, infiltration, web attacks, heartbleed, portscan, and botnets, were used to train, evaluate, and test the IDS model. To ensure that we obtained a holistic and efficient model, we performed data balancing with synthetic minority oversampling technique (SMOTE) and adaptive synthetic (ADASYN) techniques; after that, we used stratified K-fold to split the data into training, validation, and testing sets. Based on the best two models, we construct our proposed BoostedEnsML model using LightGBM and XGBoost, as the combination of the two classifiers gives a lightweight yet efficient model, which is part of the target of this research. Experimental results show that BoostedEnsML outperformed existing ensemble models in terms of accuracy, precision, recall, F-score, and area under the curve (AUC), reaching 100% in each case on the selected datasets for multiclass classification.

show abstract

Section: Results and Discussionmentioning

confidence: 71%

“…According to [ 11 ], authors proposed an IDS based on ensemble ML. The system achieved an accuracy of 99.3% during testing.…”

Section: Introductionmentioning

confidence: 99%

BoostedEnML: Efficient Technique for Detecting Cyberattacks in IoT Systems Using Boosted Ensemble Machine Learning

Okey

Maidin

Adasme

et al. 2022

Sensors

View full text Add to dashboard Cite

show abstract

“…It can be noted that a plethora of works has been proposed to increase detection accuracy in the field of network-based intrusion detection. However, despite the promising reported results, such as those obtained by traditional machine learning [28], [29], deep learning [30], [31], or even through deep reinforcement learning techniques [8], [36]- [38], their actual deployment in the production environment remains low. The challenges of networked production environments remain neglected by the literature, and the traditional ML evaluation procedure occurs.…”

Section: Discussionmentioning

confidence: 99%

“…Some related works (e.g., [28]) mention that adopting an ensemble of classifiers may be able to increase the chances of always employing the most accurate of their models for detection. In such a context, Das et al [29] evaluates the classification accuracy of several ensemble ML techniques in publicly available intrusion datasets, showing that such approaches can achieve higher detection accuracies when compared to the single classifiers approach. However, if all adopted models decrease the detection accuracy immediately after the testing phase, this ensemble classifier may not be very helpful.…”

Section: A Machine Learning For Intrusion Detectionmentioning

confidence: 99%

Reinforcement Learning for Intrusion Detection: More Model Longness and Fewer Updates

Santos

Viegas

Santin

et al. 2023

IEEE Trans. Netw. Serv. Manage.

View full text Add to dashboard Cite

Several works have used machine learning techniques for network-based intrusion detection over the past few years. While proposed schemes have been able to provide high detection accuracies, they do not adequately handle the changes in network traffic behavior as time passes. Researchers often assume that model updates can be performed periodically as needed, although this is not easily feasible in real-world scenarios. This paper proposes a new intrusion detection model based on a reinforcement learning approach that aims to support extended periods without model updates. The proposal is divided into two strategies. First, it applies machine learning scheme as a reinforcement learning task to long-term learning -maintaining high reliability and high classification accuracies over time. Second, model updates are performed using a transfer learning technique coped with a sliding window mechanism that significantly decreases the need for computational resources and human intervention. Experiments performed using a new dataset spanning 8TB of data and four years of real network traffic indicate that current approaches in the literature cannot handle the evolving behavior of network traffic. Nevertheless, the proposed technique without periodic model updates achieves similar accuracy rates to traditional detection schemes implemented with semestral updates. In the case of performing periodic updates on our proposed model, it decreases the false positives up to 8%, false negatives up to 34%, with an accuracy variation up to only 6%, while demanding only seven days of training data and almost five times fewer computational resources when compared to traditional approaches.

show abstract

“…Ensemble learning is a technique that combines various base learning models to create an enhanced single model. Because an aggregation of several learners performs better than a single learner, ensemble learning is commonly utilized in data analytics challenges, including network attack detection [57], [58].…”

Section: Eletl-ids: Proposed Ensemble Transfer Learning Modelmentioning

confidence: 99%

Transfer Learning Approach to IDS on Cloud IoT Devices Using Optimized CNN

et al. 2023

View full text Add to dashboard Cite

Data centralization can potentially increase Internet of Things (IoT) usage. The trend is to move IoT devices to a centralized server with higher memory capacity and a more robust management interface. Hence, a larger volume of data will be transmitted, resulting in more network security issues. Cloud IoT offers more advantages for deploying and managing IoT systems through minimizing response delays, optimal latency, and effective network load distribution. As a result, sophisticated network attack strategies are deployed to leverage the vulnerabilities in the extensive network space and exploit user information. Several attempts have been made to provide network intrusion detection systems (IDS) to the cloud IoT interface using machine learning and deep learning approaches on dedicated IDS datasets. This paper proposes a transfer learning IDS based on the Convolutional Neural Network (CNN) architecture that has shown excellent results on image classification. We use five pre-trained CNN models, including VGG16, VGG19, Inception, MobileNet, and EfficientNets, to train on two selected datasets: CIC-IDS2017 and CSE-CICIDS2018. Before the training, we carry out preprocessing, imbalance treatment, dimensionality reduction, and conversion of the feature vector into images suitable for the CNN architecture using Quantile Transformer. Three best-performing models (InceptionV3, MobileNetV3Small, and EfficientNetV2B0) are selected to develop an ensemble model called efficient-lightweight ensemble transfer learning (ELETL-IDS) using the model averaging approach. On evaluation, the findings show that the ELETL-IDS outperformed existing state-of-the-art proposals in all evaluation metrics, reaching 100% in accuracy, precision, recall, and F-score. We use Matthew's Correlation Coefficient (MCC) to validate this result and compared it to the AUC-ROC, which maintained an exact value of 0.9996. To this end, our proposed model is lightweight, efficient, and reliable enough to be deployed in cloud IoT systems for intrusion detection.

show abstract

Network Intrusion Detection and Comparative Analysis Using Ensemble Machine Learning and Feature Selection

Cited by 45 publications

References 32 publications

BoostedEnML: Efficient Technique for Detecting Cyberattacks in IoT Systems Using Boosted Ensemble Machine Learning

BoostedEnML: Efficient Technique for Detecting Cyberattacks in IoT Systems Using Boosted Ensemble Machine Learning

Reinforcement Learning for Intrusion Detection: More Model Longness and Fewer Updates

Transfer Learning Approach to IDS on Cloud IoT Devices Using Optimized CNN

Contact Info

Product

Resources

About