An Ensemble-Based Scalable Approach for Intrusion Detection Using Big Data Framework.

Area of Science:

• Computer Science
• Cybersecurity
• Data Analytics

Background:

• Intrusion detection systems often face imbalanced datasets, where minority classes (attacks) are underrepresented.
• Standard classification algorithms can be biased towards the majority class, leading to poor detection of malicious activities.
• Evaluating performance on imbalanced data requires specialized metrics beyond simple accuracy.

Purpose of the Study:

• To establish a scalable big data framework for processing and analyzing intrusion datasets.
• To identify and optimize the best-performing classification method for intrusion detection.
• To develop and evaluate an ensemble approach for mitigating class imbalance in cybersecurity data.

Main Methods:

• Implementation and tuning of popular classification methods on intrusion datasets.
• Optimization of hyperparameters for selected classifiers.
• Development of an ensemble method combining K-Means, RUSBoost, and Decision Tree (DT) for class imbalance.
• Evaluation using metrics like Balanced Accuracy, Matthews Correlation Coefficient, and F-Measure.

Main Results:

• The Decision Tree (DT) classifier demonstrated superior performance in accuracy, training speed, and prediction rate.
• The proposed ensemble method effectively addressed the class imbalance problem.
• Performance metrics suitable for imbalanced datasets confirmed the effectiveness of the ensemble approach.

Conclusions:

• A scalable big data framework was successfully established for intrusion data analysis.
• The Decision Tree (DT) is a highly effective base classifier for intrusion detection.
• The novel ensemble method significantly improves the detection of minority classes in imbalanced cybersecurity datasets.