Improved Hybrid Model-Based Machine and Deep Learning Approach for Intrusion Detection System

Abstract

The Intrusion Detection Systems (IDSs) are very important tools for defending a network against emerging cyber threats. This study proposes the hybrid intrusion detection system model of extreme gradient boosting (XGBoost) and KMeans++ clustering algorithm to balance the trade-off between accuracy, efficiency, and robustness in detecting malicious traffic. XGBoost algorithms are good for structured problems where classification problems occur, whereas KMeans++ helps you to get more clustering accuracy by helping centroid initialization. For enhancing the performance of the model some feature extraction steps and data preprocessing steps like normalization, encoding, Synthetic Minority Over-sampling Technique (SMOTE) based imbalance data balancing were considered. The system was trained and validated on Canadian Institute for Cybersecurity Intrusion Detection System (CICIDS) 2017 and put to test in various metrics: accuracy, precision, recall, F1-score, ROC-AUC and false positive rate. Comparative analysis was performed using traditional machine learning models such as SVM, Decision Tree, Random Forest, Naive Bayes and deep learning architectures which include CNN, LSTM and Auto-Encoder. It was found to be high detection accuracy of 99.87% with very low FPR by far i.e. 0.1%. The model provided high recall and precision in different types of attack and successful overfitting resistance could be confirmed using 10-fold cross-validation, XGBoost regularization and structure clustering. This work shall play an important role in improving hybrid models to minimize alert fatigue with trustworthy threat classification in the real operational traffic.