A novel time efficient learning-based approach for smart intrusion detection system

Journal of Big Data

Gurvinder Singh¹  Kuljit Kaur Chahal¹  Sugandh Seth¹ 

[1] Dept. of Computer Science and Engg., Guru Nanak Dev University, Amritsar, India;

关键词: Intrusion Detection System;    Realistic;    Responsive;    Imbalanced Dataset;    Machine Learning;    Prediction latency;    Time-Efficient;    Hybrid Feature Selection;    CIC-IDS-2018;   

DOI  :  10.1186/s40537-021-00498-8

来源: Springer

【 摘 要 】

BackgroundThe ever increasing sophistication of intrusion approaches has led to the dire necessity for developing Intrusion Detection Systems with optimal efficacy. However, existing Intrusion Detection Systems have been developed using outdated attack datasets, with more focus on prediction accuracy and less on prediction latency. The smart Intrusion Detection System framework evolution looks forward to designing and deploying security systems that use various parameters for analyzing current and dynamic traffic trends and are highly time-efficient in predicting intrusions.AimsThis paper proposes a novel approach for a time-efficient and smart Intrusion Detection System.MethodHerein, we propose a Hybrid Feature Selection approach that aims to reduce the prediction latency without affecting attack prediction performance by lowering the model's complexity. Light Gradient Boosting Machine (LightGBM), a fast gradient boosting framework, is used to build the model on the latest CIC-IDS 2018 dataset.ResultsThe proposed feature selection reduces the prediction latency ranging from 44.52% to 2.25% and the model building time ranging from 52.68% to 17.94% in various algorithms on the CIC-IDS 2018 dataset. The proposed model with hybrid feature selection and LightGBM gives 97.73% accuracy, 96% sensitivity, 99.3% precision rate, and comparatively low prediction latency. The proposed model successfully achieved a raise of 1.5% in accuracy rate and 3% precision rate over the existing model. An in-depth analysis of network parameters is also performed, which gives a deep insight into the variation of network parameters during the benign and malicious sessions.

【 授权许可】

CC BY