A Hybrid Intrusion Detection Model Using EGA-PSO and Improved Random Forest Method.

Area of Science:

• Computer Science
• Cybersecurity
• Artificial Intelligence

Background:

• The proliferation of IT technology has led to increased digital data availability, creating novel security threats.
• Intrusion Detection Systems (IDS) are crucial for preventing malicious intrusions and identifying suspicious network behavior.
• Machine learning (ML)-based IDS often suffer from high false detection rates and data imbalance issues due to limited training datasets.

Purpose of the Study:

• To develop an efficient hybrid network-based intrusion detection system (HNIDS) to address data imbalance issues in ML-based IDS.
• To enhance the accuracy and reduce false positives in intrusion detection through a novel hybrid approach.

Main Methods:

• The proposed HNIDS utilizes a hybrid of enhanced genetic algorithm and particle swarm optimization (EGA-PSO) to balance datasets by enhancing minor data samples.
• The EGA-PSO method improves feature selection and vector optimization, aiming to minimize dimensions and enhance true positive rates (TPR) while lowering false positive rates (FPR).
• An improved random forest (IRF) method is employed to eliminate insignificant attributes and prevent overfitting, further refining the classifier's performance.

Main Results:

• The proposed HNIDS model achieved a high accuracy of 98.979% on BCC and 88.149% on MCC using the NSL-KDD benchmark dataset.
• The experimental findings indicate that the HNIDS method significantly outperforms existing ML methods such as SVM, RF, LR, NB, LDA, and CART.

Conclusions:

• The developed HNIDS model effectively addresses data imbalance issues in ML-based IDS.
• The hybrid approach combining EGA-PSO and IRF demonstrates superior performance in intrusion detection compared to traditional ML methods.