A Practical Application of a Dataset Analysis in an Intrusion Detection System

In this paper a systematic analysis of a public intrusion detection dataset has been developed in order to understand how the traffic behaves in this particular context. This analysis is used for avoiding common pitfalls introduced because of a misunderstanding of data peculiarities and for selecting and tailoring correctly the algorithms. Specifically, we have employed machine learning algorithms to classify the traffic into normal and attack flows. In addition, it is important to decide what features should be evaluated. Typically, standard metrics do not take into account time spent in the classification, what is essential in an intrusion detection system. This is the reason why we introduce a metric that considers both the accuracy and the delay to make the decision and that is employed for evaluating machine learning algorithms in other domains. The conclusions obtained from our dataset analysis can be used to develop new models that could fit the data better than existing approaches.