MULTI-STAGE OPTIMIZED MACHINE LEARNING FRAMEWORK FOR NETWORK INTRUSION DETECTION

Abstract

With the growing reliance of individuals and organizations on the Internet,
cybersecurity has become a paramount concern, prompting the development of
various machine learning (ML)-based network intrusion detection systems (NIDSs) to
combat malicious online activities. This paper introduces a novel multi-stage
optimized ML-based NIDS framework aimed at reducing computational complexity
while maintaining high detection performance. The study investigates the impact of
oversampling techniques on training sample size, identifying the minimal suitable
sample size. Furthermore, it compares the efficacy of two feature selection methods,
information gain, and correlation-based, assessing their influence on detection
performance and time complexity. Additionally, the research explores various ML
hyper-parameter optimization techniques to enhance the NIDS's effectiveness.
Evaluation of the proposed framework employs two recent intrusion detection
datasets, CICIDS 2017 and UNSW-NB 2015, demonstrating significant reductions in
training sample size (up to 74%) and feature set size (up to 50%). Moreover, through
hyper-parameter optimization, the model achieves detection accuracies exceeding 99%
for both datasets, surpassing recent literature works by 1-2% higher accuracy and 1-2%
lower false alarm rates.