The Use of Ensemble Models for Multiple Class and Binary Class Classification for Improving Intrusion Detection Systems

Abstract

The pursuit to spot abnormal behaviors in and out of a network system is what led to a system known as intrusion detection systems for soft computing besides many researchers have applied machine learning around this area. Obviously, a single classifier alone in the classifications seems impossible to control network intruders. This limitation is what led us to perform dimensionality reduction by means of correlation-based feature selection approach (CFS approach) in addition to a refined ensemble model. The paper aims to improve the Intrusion Detection System (IDS) by proposing a CFS + Ensemble Classifiers (Bagging and Adaboost) which has high accuracy, high packet detection rate, and low false alarm rate. Machine Learning Ensemble Models with base classifiers (J48, Random Forest, and Reptree) were built. Binary classification, as well as Multiclass classification for KDD99 and NSLKDD datasets, was done while all the attacks were named as an anomaly and normal traffic. Class labels consisted of five major attacks, namely Denial of Service (DoS), Probe, User-to-Root (U2R), Root to Local attacks (R2L), and Normal class attacks. Results from the experiment showed that our proposed model produces 0 false alarm rate (FAR) and 99.90% detection rate (DR) for the KDD99 dataset, and 0.5% FAR and 98.60% DR for NSLKDD dataset when working with 6 and 13 selected features.

SAAE-DNN: Deep Learning Method on Intrusion Detection

“…The number of neurons in the latent layer of each AAE is 90 and 80, respectively, the optimizer of each AAE is Adam, and the activation function of each layer is ReLU. The number of neurons in each hidden layer of DNN is [50, 25,10], the activation function of each hidden layer is also ReLU, the activation function of the output layer is softmax for classification, and the optimizer is Adam. Two important parameters need to be set, including learning rate and epoch.…”

“…Deep learning methods can automatically extract features and classify to realize intrusion detection, such as autoencoders [7], long short term memory (LSTM) [8], and deep neural networks (DNN) [9]. The ensemble learning method uses various ensemble and hybrid technologies for intrusion detection, including bagging [10], boosting [11], stacking [12], and combined classifier methods [13].…”

The Effective Methods for Intrusion Detection With Limited Network Attack Data: Multi-Task Learning and Oversampling

“…For instance, in 2020, six different machine learning models (Decision Tree, Random Forest, K Nearest Neighbor, Adaboost, Gradient Boosting, and Linear Discriminant Analysis) were implemented using the CICIDS2018 dataset [10], and Zhou et al [5] proposed an XSS attack detection method based on an ensemble learning approach learnt with domain knowledge and threat intelligence. In order to obtain high accuracy, high packet detection rate, and low false positive rate of AID-S, Iwendi et al [11] proposed a CFS + Ensemble Classifiers. Besides, Jiang et al [12] proposed the PSO-XGBoost model given its overall higher classification accuracy than other alternative models such like XGBoost, Random Forest, Bagging and Adaboost and Liu et al [13] presented an intrusion detection model with hierarchical attention mechanism.…”

K-Submodlar Function Based Incentive Mechanisms for Crowd Multi-Labeling

“…However, in many real-world applications, an instance may have more than one label (Especially, an image may contain multiple objects, where each object corresponds to one label.) such as the documents' categorisation, image labeling, gene function prediction, intrusion detection system [2]- [4] and multi-agent crowd sensing applications of industrial systems [5], [6]. To the end, we will investigate the issue of MCL.…”