Performance comparison of random forest and BILSTM for intrusion detection in cyber security environment

The widespread adoption of the internet has led to an increase in network attacks, making traditional signature-based detection methods less effective against zero-day attacks. This research examines the efficacy of anomaly-based detection techniques in identifying these threats, using two artificial intelligence models: CNN-BiLSTM and random forest classifier. Data for training and testing these models was sourced from the CICIDS2017 dataset. Results showed a high success rate, with CNN-BiLSTM achieving 95% and random forest classifier achieving 98%. These findings suggest that anomaly-based detection offers a robust strategy for detecting zero-day network attacks. The research also underscores the necessity of assessing detection systems through various performance metrics, including accuracy, precision, recall, and F1 score. Such metrics provide a comprehensive understanding of an algorithm's effectiveness in diverse scenarios, which is crucial for developing more advanced and secure network security systems capable of addressing emerging threats.