Analysis of supervised machine-learning techniques in computer networks attack detection

Abstract

In an era marked by an increasing reliance on technology in our daily lives, the imperative to ensure the availability and security of infrastructures supporting system operations is evident. This commitment is crucial for guaranteeing service quality, delivering a positive end-user experience, and optimizing resource utilization. Against this backdrop, the integration of new technologies, such as artificial intelligence and machine-learning, becomes essential to enhance the agility of problem detection and mitigate potential impacts. The study presented in this paper delves into an analysis of various supervised classifier machine-learning methods applied to data collected from network equipment, specifically switches. The primary objective is to detect attacks within the network infrastructure of a higher education institution. The attacks were categorized into distinct signatures, forming datasets instrumental in the comparative assessment of machine-learning techniques. The models derived from these methods demonstrated promising results, achieving an impressive 99.88% in the Weighted F1 metric and 99.23% in Balanced Accuracy. Beyond traditional metrics, the study also considered critical factors such as training time, prediction time, and saved file size for a comprehensive evaluation of the methods. This multifaceted analysis aids in identifying the most suitable method, taking into account not only classification performance but also practical considerations associated with real-world deployment.