A dual-layer AI-based approach for real-time network intrusion detection using random forest and autoencoder

Abstract

The implementation of IDSs for intrusion detection based on machine learning has been the subject of extensive research to address the growing threats posed by network intrusions. Nonetheless, there are several problems that must be resolved. Poor detection rates are generated for unknown threats because they are challenging to handle when they do not occur in the training set. IDSs can have a high risk of false positives. Since different models learn data features from different angles, our work introduces a hybrid intrusion detection system (IDS) that combines Random Forest (RF) and Autoencoder (AE). This study implements the combination of RF and AE intrusion detection systems. The hybrid model has two distinct operational phases. We employ the RF classifier's probability output in the first phase for analysis. The system determines, in its first phase, whether the examined sample constitutes an attack. The probability output becomes an essential element for identification. To identify unknown attacks, adding a second Autoencoder helps reduce false positives in the second stage. We specifically remove some samples from one attack class from the training set to simulate an unidentified attack in trials. Our proposed method shows a high detection rate when compared to other baselines. Furthermore, an AE detection module integrated into the system helps decrease the false detection rate. replace word moreover.