Anomaly-Based Intrusion Detection Using Machine Learning: An Ensemble Approach

Intrusion detection systems were developed to detect any suspicious traffic in the network. Conventional intrusion detection comes with its sets of limitations. The authors aimed to improve anomaly-based intrusion detection using an ensemble approach of machine learning. In this article, CICIDS2017 and CICIDS 2018 datasets have been used for implementing the proposed method. Random forest regressor is used for feature selection. Three machine learning algorithms (i.e., naïve bayes, QDA, and ID3) are selected and combined (ensembled) for their low computational cost. The ensemble algorithm results are compared with the standalone algorithms. With the ensembled method, classification accuracy of 98.3% and 95.1%, with FAR of 2% and 6.9% were achieved on CICIDS 2017 and CICIDS 2018 datasets respectively. Naïve bayes, QDA, and ID3 have classification accuracies of 82%, 84.7%, and 95.8% respectively on CICIDS 2017; 68.3%, 68.4%, and 94.4% respectively on CICIDS 2018; false alarm rates of 54.9%, 55.5%, and 20.6% respectively on CICIDS 2017; and 3.6%, 3.7%, and 7.1% respectively on CICIDS 2018.