Comparative performance evaluation of machine learning classifiers for multi-class intrusion detection on the NSL-KDD dataset.
TL;DR
A feature-driven Intrusion Detection (ID) framework that combines XGBoost-based feature selection with multiple ML classifiers to improve attack detection performance while reducing computational complexity is proposed.
Abstract
Intrusion Detection Systems (IDSs) play a vital role in safeguarding modern network infrastructures against increasingly sophisticated cyber threats. However, the high dimensionality of network traffic data and the presence of imbalanced attack classes often limit the effectiveness of conventional Machine Learning (ML) approaches. This study proposes a feature-driven Intrusion Detection (ID) framework that combines XGBoost-based feature selection with multiple ML classifiers to improve attack detection performance while reducing computational complexity. The NSL-KDD dataset is utilized to evaluate the proposed approach across five traffic classes: Benign, Denial of Service (DoS), Probe, Remote-to-Local (R2L), and User-to-Root (U2R). XGBoost feature ranking is employed to identify thirteen highly relevant features for each attack category, thereby reducing data dimensionality and eliminating redundant attributes. The selected features are subsequently evaluated using six ML classifiers, namely LightGBM, Voting Classifier, CatBoost, Multi-Layer Perceptron (MLP), AdaBoost, and Stochastic Gradient Descent (SGD). Performance assessment is conducted using Precision, Recall, F1-Score, confusion matrices, and cross-validation analysis. Experimental results demonstrate that ensemble-based models, particularly CatBoost and LightGBM, achieve superior performance for majority attack classes such as DoS and Probe, while all classifiers exhibit challenges in detecting minority classes such as R2L and U2R due to severe class imbalance. Cross-validation results confirm the robustness and stability of the selected feature subsets across different attack categories. Furthermore, a computational complexity analysis highlights the suitability of the proposed framework for practical and resource-constrained ID environments. The findings emphasize the effectiveness of feature optimization in enhancing classification performance and provide valuable insights for the development of efficient and scalable IDS solutions.