Comparative performance evaluation of machine learning classifiers for multi-class intrusion detection on the NSL-KDD...

Area of Science:

• Cybersecurity
• Machine Learning
• Network Security

Background:

• Intrusion Detection Systems (IDSs) are crucial for network defense.
• High dimensionality and class imbalance in network data hinder conventional Machine Learning (ML) effectiveness.
• Sophisticated cyber threats necessitate advanced detection methods.

Purpose of the Study:

• To propose a feature-driven Intrusion Detection (ID) framework.
• To enhance attack detection performance and reduce computational complexity in IDSs.
• To leverage XGBoost for feature selection and evaluate multiple ML classifiers on the NSL-KDD dataset.

Main Methods:

• Utilized the NSL-KDD dataset with five traffic classes: Benign, Denial of Service (DoS), Probe, Remote-to-Local (R2L), and User-to-Root (U2R).
• Employed XGBoost feature ranking to identify thirteen highly relevant features per attack category, reducing data dimensionality.
• Evaluated selected features using six ML classifiers: LightGBM, Voting Classifier, CatBoost, Multi-Layer Perceptron (MLP), AdaBoost, and Stochastic Gradient Descent (SGD).

Main Results:

• Ensemble models, specifically CatBoost and LightGBM, showed superior performance for majority classes (DoS, Probe).
• All classifiers faced challenges with minority classes (R2L, U2R) due to severe class imbalance.
• Cross-validation confirmed the robustness and stability of selected feature subsets across attack categories.

Conclusions:

• Feature optimization is effective in enhancing ML classification performance for Intrusion Detection.
• The proposed framework is suitable for practical, resource-constrained ID environments.
• Findings offer insights for developing efficient and scalable IDS solutions.