Anomaly Based Network Intrusion Detection Using Ensemble Classifiers

Network Intrusion Detection System is extensively utilized for protection and reducing the damages of information system. It protects threats and vulnerabilities in computer network. Due to the rapid growth of computer network communications, network intrusion is significantly increased and the intrusion detection is considered as a major issue in nowadays. For secure the communication, it is necessary to identify network attacks or malicious activities in network environment. To detect the intrusion in the network various methods have been proposed in past and effective analysis based on ensemble machine learning methods have been done to detect any types of anomalous events occurred in the flow of network traffic. In the learning process, ensemble methods are known to perform well. Investigating the best ensemble approach is crucial for creating an effective network intrusion detection system. In this paper, we used Bagged Naïve Bayes-Decision Tree (BNBDT) and Random Forest ensemble learning techniques and also used four base classification algorithms which are Naïve Bayes, KNN, Decision Tree and Logistic Regression on NSL-KDD network attack dataset for detecting the anomaly in network traffic and compared the performance of ensemble classifiers with the base classifiers. The proposed ensemble method provides better accuracy and relatively low false alarms rate than the other base classifiers.

I. Introduction

The continuous and rapid technological progress, associated with the need of networking, interconnection and integration of newly systems has implicated to need of higher security provisioning. Information security is a crucial component for defending any organization’s vital data. Any organization that wants to safeguard its networks from unwanted attacks must use security mechanisms. The intruder is identified by the network intrusion detection system which then takes the proper action against the attacker [1]. The attackers attack the system resources for getting the access and collect or destroy valuable information. Network attack can be occurred in various forms. Enterprises need to maintain the highest network security policies, self-training and network security standards to safeguard their assets against the increasingly network threats. Most common types of network attacks are as follows: Man in the middle attack, Denial of service (DoS) attack, DDoS attack, Password attacks such as Brute Force, Surfing and Dictionary, Phishing attack, Malware attack, Ransomware, Botnet attack, SQL Injection, Social Engineering attack and Eavesdropping [2].