Performance Evaluation of Network Intrusion Detection Using Machine Learning
Sajepan Gnanasivam, Daniel Tveter, Nga T. Dinh · 2024
The development of 5G network and beyond has led to an explosion of data generation. It is therefore crucial to have an intrusion detection system (IDS) to detect and remove malicious packets from entering network. This paper therefore presents an IDS based on a Feature Selection approach which applies the Recursive Feature Elimination and Random Forest Classifier with 10 -fold Cross Validation to classify malicious and benign traffic on a publicly available UNSW-NB15 dataset. Most existing Feature Selection approaches on this dataset directed to enhance the performance of a limited number of algorithms used. Our proposed Feature Selection approach was tested on six well-known supervised machine learning (ML) algorithms including Artificial Neural Network (ANN), Random Forest (RF), Decision Tree (DT), K-Nearest Neighbor (KNN), Support Vector Machines (SVM) and Logistic Regression (LR) performing binary classification. In addition, we performed hyperparameter tuning to get the best possible parameters for each ML algorithm. Unlike hyperparameter tuning in most studies, we perform both Manual Search and Grid Search. The performance of the selected ML algorithms are evaluated based on Accuracy, Recall, Precision, and F1 score. The results from our experiments indicate that the most robust algorithm is ANN whereas the weakest performing algorithm is LR. RF is the second-best performing algorithm, however, its runtime is much lower than that of ANN. In particular, ANN excels with (testing accuracy, F1 score) of (88.62%, 96.473%), RF with (87.40%, 89.60%), DT with (87.266%, 89.414%), KNN with (87.11%, 88.7%), SVM with (81.835%, 86.959%) and LR with (81.835%, 85.632%). In addition, the over-fitting problems are eliminated based on our proposed Feature Selection and Hyperparameter turning. Compared with existing works with the same ML algorithms on UNSW-NB15 dataset, our proposed Feature Selection approach achieved better results in most cases and more stable among different ML algorithms.