Towards Data-Driven Network Intrusion Detection Systems: Features Dimensionality Reduction and Machine Learning

Abstract

Cyberattacks have increased in tandem with the exponential expansion of computer networks and network applications throughout the world. In this study, we evaluate and compare four features selection methods, seven classical machine learning algorithms, and the deep learning algorithm on one million random instances of CSE-CIC-IDS2018 big data set for network intrusions. The dataset was preprocessed and cleaned and all learning algorithms were trained on the original values of features. The feature selection methods highlighted the importance of features related to forwarding direction (FWD) and two flow measures (FLOW) in predicting the binary traffic type; benign or attack. Furthermore, the results revealed that whether models are trained on all features or the top 30 features selected by any of the four features selection techniques used in this experiment, there is no significant difference in model performance. Moreover, we may be able to train ML models on only four features and have them perform similarly to models trained on all data,which may result in preferable models in terms of complexity, explainability, and scale for deployment. Furthermore, by choosing four unanimity features instead of all traffic features, training time may be reduced from 10% to 50% of the training time on all features.

A cutting-edge intelligent cyber model for intrusion detection in IoT environments leveraging future generations networks

“…To illustrate the efficacy of the approach in terms of intrusion detection, the framework is tested using a variety of simulations using the most recent CICDDoS2019 dataset. The average AWID dataset 98.54% [7] CICIDS2017 dataset 97.16% [8] Simulation dataset of 59,529 95% [9] NSL-KDD dataset 99.02% [10] NSL-KDD dataset 99.76% [11] CICDDoS2019 dataset 94% [12] CSE-CIC-IDS2018 dataset 94 % [13] Phishing dataset 88% [14] Simulation dataset 95.7% detection accuracy of the suggested solution was 94%, with a false alarm rate of 0.0952, and detection rates and precisions of 97.49% and 91.22%, respectively.…”

“…Authors in [12] used CSE-CIC-IDS2018 which is a big data set the feature selection methods has been highlighted, The experiment findings show that random forest, decision tree, KNN, Adaboost, achieved close results with average of 94%.…”

Network Attacks Classification for Network Forensics Investigation: Literature Reviews

“…Network traffic can also be viewed by analyzing network packets. Network packets are a fundamental object that can be analyzed in network forensics, this is done to collect data related to network traffic that can be used as evidence in court [21], [34], [39], [44]. The main threats of injection attacks include theft of credentials, forced access to a system and violation of the integrity of stored data.…”

Performance optimization for Intrusion Detection by Long Short Term Memory (LSTM)

“…However, they have a downside in the form of a high false-positive rate, detecting malicious and unusual traffic across the entire network attack surface. Machine learning involves the development of systems that can learn from data and uncover concealed patterns [7][8][9]. The main challenge lies in efficiently sifting through the abundant data to unearth valuable and relevant information.…”