Evaluating Security enhancement through Machine Learning Approaches for Anomaly Based Intrusion Detection Systems

A critical aspect of enhancing cybersecurity involves employing the anomaly-based Intrusion Detection System (IDS), which relies on machine learning methodologies for optimal functionality. Nonetheless, an investigation into existing IDS research uncovers issues regarding arbitrary algorithm choice, parameter selection, utilization of old datasets, and inadequate result analysis. To mitigate these challenges, a comprehensive analysis juxtaposes prior IDS studies against diverse attack scenarios and the dataset CICIDS2017. This study examines two well-known machine learning algorithms, detailing specific models for each, analyzing their training parameters, and utilizing various metrics for performance evaluation. The evaluation is conducted by the multiclass dataset CICIDS2017, which is recognized for its class imbalance and realistic representation of attacks. The results highlight the effectiveness of the first Random Forest Classifier and second Decision Tree Classifier models in detecting web attacks compared to other methods. These models demonstrate outstanding performance in terms of memory usage, A-accuracy, P-precision, and FScore, achieving an accuracy rate of 98.07% and a recall rate of 98.12%. By addressing previous shortcomings in intrusion detection system IDS research and offering insights into optimal parameters and algorithmic selections, this research contributes to a better understanding of IDS effectiveness in real-world network environments.