Novel Approach for Cyber Attack Detection in Network using Machine Learning Techniques

Abstract

Cyber-attacks on computer networks are evolving, and signature-based defence systems are struggling to keep pace. One of the more pragmatic answers to this problem has been machine learning, not because it replaces a security analyst, but because it can sift through traffic much faster than a human team while catching patterns that static rules miss. This paper investigates the performance of four supervised classifiers, namely Support Vector Machine (SVM), Decision Tree, Random Forest and an Artificial Neural Network (ANN) on the NSL-KDD dataset, which is an improved, de-duplicated version of the older KDD Cup 1999 data. All four models were run through the same pre-processing, feature engineering and validation steps so there is no skew in the comparison due to inconsistent handling of the data. It is important to note upfront how much reported IDS accuracy depends on the dataset and protocol used. For example, work on evaluating SVM on CICIDS2017 has reported precision as high as 97.80% on one attack category and as low as 69.79% on another, which is a widespread for the same algorithm. In our own runs on NSL-KDD Random Forest scored the best with 99.6% accuracy while ANN came close at 99.11% and SVM and Decision Tree stood behind at 93.29% and 83.4% respectively. The pattern suggests that ensemble tree methods are well suited for the discrete, high-dimensional structure of network connection records. The paper also puts these numbers alongside recent feature-selection- and deep-learning-based intrusion detection works to see where the classical approach still holds its ground and where it doesn’t.