Comparison of Machine Learning and Deep Learning Models for Network Intrusion Detection Systems

Abstract

The development of robust anomaly-based network detection systems, which are preferred over static signal-based network intrusion, is vital for cybersecurity. The development of a flexible and dynamic security system is required to tackle the new attacks. Current intrusion detection systems (IDSs) suffer to attain both the high detection rate and low false alarm rate. To address this issue, in this paper, we propose an IDS using different machine learning (ML) and deep learning (DL) models. This paper presents a comparative analysis of different ML models and DL models on Coburg intrusion detection datasets (CIDDSs). First, we compare different ML- and DL-based models on the CIDDS dataset. Second, we propose an ensemble model that combines the best ML and DL models to achieve high-performance metrics. Finally, we benchmarked our best models with the CIC-IDS2017 dataset and compared them with state-of-the-art models. While the popular IDS datasets like KDD99 and NSL-KDD fail to represent the recent attacks and suffer from network biases, CIDDS, used in this research, encompasses labeled flow-based data in a simulated office environment with both updated attacks and normal usage. Furthermore, both accuracy and interpretability must be considered while implementing AI models. Both ML and DL models achieved an accuracy of 99% on the CIDDS dataset with a high detection rate, low false alarm rate, and relatively low training costs. Feature importance was also studied using the Classification and regression tree (CART) model. Our models performed well in 10-fold cross-validation and independent testing. CART and convolutional neural network (CNN) with embedding achieved slightly better performance on the CIC-IDS2017 dataset compared to previous models. Together, these results suggest that both ML and DL methods are robust and complementary techniques as an effective network intrusion detection system.

Modification of a Density-Based Spatial Clustering Algorithm for Applications with Noise for Data Reduction in Intrusion Detection Systems

“…A number of studies have shown that CART is able to provide better performance in general [19][20][21]. This is supported by a study conducted by Thapa et al [22]. In this study, we developed an IDS model that combines machine learning with deep learning.…”

Deep-Feature-Based Autoencoder Network for Few-Shot Malicious Traffic Detection

“…e research by Zeng et al proposed a light-weight framework without manual intervention and private information but with the aid of deep learning for encrypted traffic classification and intrusion detection [19]. e model in [20] studied by apa et al was based on classification and regression tree (CART) and CNN and performed well in 10fold cross-validation and independent testing on dataset CIC-IDS2017 [21]. Compared with some other methods, the model brought forward by Javaid employs a self-taught learning technique on NSL-KDD and, as a result, improves the precision and recall rates [22].…”

Using Embedded Feature Selection and CNN for Classification on CCD-INID-V1—A New IoT Dataset

“…The embedded feature selection scheme has been preferred over the filter and wrapper methods [ 56 , 57 , 58 ], and has seen success in fields such as bioinformatics [ 59 , 60 ], and medical research [ 61 , 62 , 63 , 64 ], but remains relatively new in the field of IoT security.…”