MIND: A Multi-Source Data Fusion Scheme for Intrusion Detection in Networks

Area of Science:

• Computer Science
• Cybersecurity
• Data Science

Background:

• Exponential data growth in computer networks leads to increased cyber threats.
• Current Network Intrusion Detection Systems (NIDS) face challenges with resource utilization, complexity, and high false alarm rates.
• Existing intrusion detection models often suffer from overfitting and suboptimal detection capabilities.

Purpose of the Study:

• To propose a multi-source data fusion scheme for enhanced network intrusion detection.
• To address limitations of existing NIDS, including overfitting and detection accuracy.
• To develop a more precise and informative intrusion detection model.

Main Methods:

• Implemented a multi-source data fusion scheme (MIND) using horizontal emergence of two datasets.
• Utilized Hadoop MapReduce tools, specifically Hive, for data fusion.
• Employed a machine learning ensemble classifier with fewer parameters on the fused dataset.
• Evaluated the model using a 10-fold cross-validation technique.

Main Results:

• Achieved high performance metrics: 99.80% accuracy, 99.80% detection rate, 0.29% false positive rate, 99.85% true positive rate, and 99.82% F-measure.
• Demonstrated significant effectiveness in intrusion detection compared to existing state-of-the-art methods.
• The fusion technique and ensemble classifier contributed to improved detection capabilities.

Conclusions:

• The proposed multi-source data fusion scheme (MIND) offers a robust solution for network intrusion detection.
• The model effectively overcomes challenges associated with data volume and complexity in modern networks.
• This approach provides a more accurate, precise, and reliable method for identifying network intrusions.