Applying ML Algorithms to improve traffic classification in Intrusion Detection Systems

Abstract

Traditional intrusion detection systems may have higher false-positive and false-negative rates against new malicious traffic vectors. Also, in the case of anomaly-based IDS can be bypassed by generating network traffic intelligently. The capability of machine learning algorithms in capturing complex behaviors and patterns made them increasingly popular in solving classification/detection problems. The major objective of this paper is to suggest an efficient IDS model by studying various supervised machine learning algorithms on the classification problem. For this purpose, the known NSLKDD dataset was used as a source of diverse feature columns for the model The transformed data is modeled to classify network traffic into normal or attack using machine learning algorithms SVM, KNN, neural network and ensemble learning in which KNN and SVM achieved 98 and 97% accuracy. These models can be used to differentiate anomalous traffic in intrusion systems and maybe useful as a replacement for traditional rule-based detection systems. Click here for dataset and code of IDS models.