Network intrusion detection using oversampling technique and machine learning algorithms.

Area of Science:

• Computer Science
• Cybersecurity
• Machine Learning

Background:

• The internet's growth increases network security threats, necessitating advanced detection methods.
• Traditional Network Intrusion Detection Systems (NIDS) struggle to identify novel cyber attacks.
• Machine learning offers potential for more effective network traffic anomaly detection.

Purpose of the Study:

• To develop and evaluate a machine learning framework for detecting diverse network attack categories.
• To assess the performance of various classification algorithms on a contemporary network traffic dataset.
• To improve NIDS accuracy by addressing class imbalance and feature selection.

Main Methods:

• Implemented five machine learning algorithms: Random Forest, Decision Tree, Logistic Regression, K-Nearest Neighbors, and Artificial Neural Networks.
• Utilized the University of New South Wales (UNSW-NB15) dataset, containing nine network attack categories.
• Applied Synthetic Minority Oversampling Technique (SMOTE) to handle class imbalance and Principal Component Analysis (PCA) for feature selection.

Main Results:

• The Random Forest algorithm achieved the highest initial accuracy of 89.29%.
• SMOTE application significantly improved classification model accuracy.
• The Random Forest classifier, combined with SMOTE and 24 PCA-selected features, reached an accuracy of 95.1%.

Conclusions:

• Machine learning, particularly Random Forest with SMOTE, offers a robust approach to enhancing network intrusion detection.
• The UNSW-NB15 dataset provides a valuable resource for training and validating modern NIDS.
• Addressing class imbalance is crucial for improving the performance of NIDS in detecting emerging network threats.