Machine Learning for Misuse-Based Network Intrusion Detection: Overview, Unified Evaluation and Feature Choice Comparison Framework

IEEE Access, vol. 9, pp. 63995–64015

Abstract

Network Intrusion detection systems are essential for the protection of advanced communication networks. Originally, these systems were hard-coded to identify specific signatures, patterns and rule violations; now artificial intelligence and machine learning algorithms provide promising alternatives. However, in the literature, various outdated datasets as well as a plethora of different evaluation metrics are used to prove algorithm efficacy. To enable a global comparison, this study compiles algorithms for different configurations to create common ground and proposes two new evaluation metrics. These metrics, the detection score and the identification score, together reliably present the performance of a network intrusion detection system to allow for practical comparison on a large scale. Additionally, we present a workflow to process raw packet flows into input features for machine learning. This framework quickly implements different algorithms for the various datasets and allows systematic performance comparison between those algorithms. Our experimental results, matching and surpassing the state-of-the-art, indicate the potential of this approach. As raw traffic input features are much easier and cheaper to extract when compared to traditional features, they show promise for application in real-time deep learning-based systems.

Authors 3

1. Laurens Le Jeune

   KU Leuven · IMEC

   Affiliation as printed

   EAVISE, PSI, KU Leuven, Leuven, Belgium

   ES&S and imec-COSIC, KU Leuven, Leuven, Belgium

2. Toon Goedemé

   KU Leuven

   Affiliation as printed

   EAVISE, PSI, KU Leuven, Leuven, Belgium

3. Nele Mentens Aachen Leiden Institute of Advanced Computer Science

   Leiden University · KU Leuven · IMEC

   Affiliation as printed

   ES&S and imec-COSIC, KU Leuven, Leuven, Belgium

   Leiden Institute of Advanced Computer Science (LIACS), Leiden University, Leiden, The Netherlands