Memory-Efficient Random Forest Generation Method for Network Intrusion Detection

Abstract

Along with the steady growth of wired and wireless networks, the various new attacks targeting networks are also constantly emerging and transforming. As a efficient way to cope with various attacks, the Random Forest(RF) algorithm has frequently been used as the core engine of intrusion detection because of the faster learning speed and the higher attack detection accuracy. However, the RF algorithm has to input the number of the tree composing the forest as a parameter. In this paper, we proposed a new algorithm that limit the number of trees composing the forest using the McNemar test. To evaluate the performance of the proposed RF algorithm, we compared learning time, accuracy and memory usage of the proposed algorithm with the original RF algorithm and other algorithm by using the KDDcup99 dataset. Under the same detection accuracy, the proposed RF algorithm improves the performance of the original RF algorithm by as much as 97.76% at learning time, 91.86% at test time, and 99.02% in memory usage on average.