Development and Evaluation of a Hybrid Machine Learning-Based Intrusion Detection System Using NSL-KDD Dataset

Abstract

Study’s Excerpt

• Hybrid-Base Intrusion Detection System (IDS) that combines anomaly detection and signature-based techniques is introduced.
• Using various metrics, the system could optimize network settings thereby addressing zero-day attack detection issue.
• The system demonstrates an accuracy of 99.73% and a false positive rate of 0.065 on the NSL-KDD benchmark dataset.

Full Abstract

The growth of IoT devices has resulted in a rise of attack surfaces like firmware, sensitive data in physical interfaces, and default settings.  Intrusion Detection Systems (IDSs) in networks are used to alert network administrators to critical issues.  Zero-day attack detection is an important topic of research in the field of malicious traffic identification.  Current methods rely on Machine Learning (ML) approaches for intrusion detection systems (IDSs); nevertheless, the efficacy of the methodology mechanism is dependent on the feature learning procedure, which is still an unresolved problem.  As a consequence, in this article, a Hybrid-Base IDS was implemented, with various metrics used to optimise the network settings.  In the simulation, the Network Security Laboratory – Knowledge Discovery Dataset (NSL-KDD) benchmark dataset was employed, as well as measures including accuracy, recall, False Positive Rate (FPR), True Positive Rate (TRP), and other aligned metrics.  The paper presents a hybrid intrusion detection system (IDS) combining anomaly detection and signature-based techniques, using machine learning models such as Random Forest and Support Vector Machines.  Our model achieved an accuracy of 99.73% and a false positive rate of 0.065, outperforming existing methods of Hadeel et al. (2024) and demonstrating its potential for real-world application.  We also ran a comparison study with other current approaches, and the findings show that the suggested IDS scheme is effective in real-world cybersecurity scenarios.  For future investigations, it is proposed that the Ensemble approach and real-time implementation be used, which will allow the model to continue operating in real-time circumstances.