Evaluation of the performance of supervised and unsupervised Machine learning techniques for intrusion detection

Abstract

machine learning techniques are widely used in the research for intelligent solutions anomalies detection on different computers and communications systems, which have allowed to modernize the intrusion detection systems, to ensure data privacy. For that, this paper evaluates the performance of some supervised (i.e., KNN and SVM) and unsupervised (i.e., Isolation Forest and K-Means) algorithms, for intrusion detection, using data set UNSW-NB12. The results show that the supervised algorithm SVM gaussiana fine, obtained 92% in accuracy, indicating the ability to correctly classify normal and abnormal data. With regard to the unsupervised algorithms, the K-Means algorithm groups the data together correctly and allows the appropriate number of groups to be clearly defined; however, this data set is highly agglomerated. For Isolation Forest, despite being a robust algorithm for the separation of atypical values, it presented difficulty for it. Finally, it should be made clear that not all methods of detecting anomalies by distance work properly for all data sets.