Comparison of ML-based One-Stage and Two-Stage NIDS Models

Machine learning has a broad range of cybersecurity applications. Network intrusion detection systems provide support to cybersecurity professionals by analyzing network traffic. This study compares K-nearest neighbor and neural network-based Network Intrusion Detection Systems. For this purpose, a network topology was created in a virtual lab. "normal" and "abnormal" network packets were captured. All packets were labeled. An One-Stage multi classification Neural Network model, a Two-Stage multi classification model, an One-Stage multi classification K-Nearest Neighbor model and a Two-Stage Neural Network-K Nearest Neighbor Mixed model was created. Backward elimination was used for the K-Nearest Neighbor models for feature selection. For the algorithms, the parameter values that maximize the F1, recall, precision and accuracy scores were found. The scores of models are between 0.92 and 0.98.