Performance Evaluation of Classification Algorithms for Intrusion Detection on NSL-KDD Using Rapid Miner

Malik, Zoraez Ashfaq; Siddique, Marriam; Paracha, Zahir Javed; Imran, Azhar; Yasin, Amanullah; Butt, Abdul Hameed

doi:10.33411/ijist/2022040110

Cited by 4 publications

(1 citation statement)

References 14 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…In our case, Decision Tree (DT) has shown much better results than the Support Vector Machine and Naïve Bayes with higher accuracy that is around 99.67%. Various studies on machine learning have been conducted that show the emergence of ML in daily dynamics [52,53,54,55,56,57,58,59].…”

Section: 𝑇𝑃 𝑇𝑃 + 𝐹𝑃mentioning

confidence: 99%

Analyzing ML-Based IDS over Real-Traffic

Siyyal

Khuawar

Saba

et al. 2022

IJIST

View full text Add to dashboard Cite

The rapid growth of computer networks has caused a significant increase in malicious traffic, promoting the use of Intrusion Detection Systems (IDSs) to protect against this ever-growing attack traffic. A great number of IDS have been developed with some sort of weaknesses and strengths. Most of the development and research of IDS is purely based on simulated and non-updated datasets due to the unavailability of real datasets, for instance, KDD '99, and CIC-IDS-18 which are widely used datasets by researchers are not sufficient to represent real-traffic scenarios. Moreover, these one-time generated static datasets cannot survive the rapid changes in network patterns. To overcome these problems, we have proposed a framework to generate a full feature, unbiased, real-traffic-based, updated custom dataset to deal with the limitations of existing datasets. In this paper, the complete methodology of network testbed, data acquisition and attack scenarios are discussed. The generated dataset contains more than 70 features and covers different types of attacks, namely DoS, DDoS, Portscan, Brute-Force and Web attacks. Later, the custom-generated dataset is compared to various available datasets based on seven different factors, such as updates, practical-to-generate, realness, attack diversity, flexibility, availability, and interoperability. Additionally, we have trained different ML-based classifiers on our custom-generated dataset and then tested/analyzed it based on performance metrics. The generated dataset is publicly available and accessible by all users. Moreover, the following research is anticipated to allow researchers to develop effective IDSs and real traffic-based updated datasets.

show abstract

Section: 𝑇𝑃 𝑇𝑃 + 𝐹𝑃mentioning

confidence: 99%

Analyzing ML-Based IDS over Real-Traffic

Siyyal

Khuawar

Saba

et al. 2022

IJIST

View full text Add to dashboard Cite

show abstract

Harris hawk optimization trained artificial neural network for anomaly based intrusion detection system

Narengbam

Dey

2023

Concurrency and Computation

View full text Add to dashboard Cite

SummaryAn integral part of security infrastructure is detecting and identifying malicious attacks commonly found in network environments. Despite its effectiveness at identifying anomalous network behaviors, an intrusion detection system (IDS) still has a low detection rate and a high rate of false alarms. This study proposes a novel effective anomaly IDS by integrating bio‐inspired optimization techniques, Harris hawk optimization (HHO), and an artificial neural network (ANN), called HHO‐ANN. Several experiments were conducted with other methods to verify the performance and capabilities of the proposed technique. The AWID, CIDDS001, NSL‐KDD, and NSL‐KDD datasets were used to benchmark the performance of the proposed method. Popular evolutionary algorithms, such as genetic algorithm, particle swarm optimization, moth‐flame optimization, and locust swarm optimization based on ANN trainer, were implemented to validate the result. Comparison with existing methods in the literature reveals that the proposed method offers more accuracy. Simulation results confirm that the proposed method has excellent speed convergence and a high‐reliability level due to a lower risk of getting stuck in the local minima region. The proposed method achieved accuracy of 96.71%, 98.03%, 98.25%, and 97.95% for AWID, CIDDS‐001, NSL‐KDD, and UNSW‐NB15, respectively.

show abstract