Development and Evaluation of a Hybrid Machine Learning-Based Intrusion Detection System Using NSL-KDD Dataset
Oluwagbenga Esther Mercy Olugbenga, Taiwo Kolajo, Joshua Agbogun Babatunde · UMYU Scientifica · 2024
Study’s Excerpt Hybrid-Base Intrusion Detection System (IDS) that combines anomaly detection and signature-based techniques is introduced. Using various metrics, the system could optimize network settings thereby addressing zero-day attack detection issue. The system demonstrates an accuracy of 99.73% and a false positive rate of 0.065 on the NSL-KDD benchmark dataset. Full Abstract The growth of IoT devices has resulted in a rise of attack surfaces like firmware, sensitive data in physical interfaces, and default settings. Intrusion Detection Systems (IDSs) in networks are used to alert network administrators to critical issues. Zero-day attack detection is an important topic of research in the field of malicious traffic identification. Current methods rely on Machine Learning (ML) approaches for intrusion detection systems (IDSs); nevertheless, the efficacy of the methodology mechanism is dependent on the feature learning procedure, which is still an unresolved problem. As a consequence, in this article, a Hybrid-Base IDS was implemented, with various metrics used to optimise the network settings. In the simulation, the Network Security Laboratory – Knowledge Discovery Dataset (NSL-KDD) benchmark dataset was employed, as well as measures including accuracy, recall, False Positive Rate (FPR), True Positive Rate (TRP), and other aligned metrics. The paper presents a hybrid intrusion detection system (IDS) combining anomaly detection and signature-based techniques, using machine learning models such as Random Forest and Support Vector Machines. Our model achieved an accuracy of 99.73% and a false positive rate of 0.065, outperforming existing methods of Hadeel et al. (2024) and demonstrating its potential for real-world application. We also ran a comparison study with other current approaches, and the findings show that the suggested IDS scheme is effective in real-world cybersecurity scenarios. For future investigations, it is proposed that the Ensemble approach and real-time implementation be used, which will allow the model to continue operating in real-time circumstances.