A Simple Distributed Approach for Running Machine Learning Based Simulations in Intrusion Detection Systems

Intrusion Detection Systems (IDS) that use Machine Learning (ML) are a must-have for success protection when thinking of network traffic. Classification algorithms within Machine Learning have already proved their value in this research field and they are already being used in real scenarios as a service. However, analysing large quantities of data, with possibly multiple distinct algorithms takes a considerable amount of computing and time resources on the training phase that are required to decide which is the most efficient classification model. We propose the use of a distributed computing platform, using the Ray Python Library, to deploy a simple parallel execution of ML training algorithms with minimal source code change. We use the well-known CICIDS 2017 dataset to evaluate an ML based IDS as the testing case. The results show that the Ray library is a simple and direct approach to the parallelism in training ML algorithms, while maintaining the same deterministic output results. The execution time of the experiments was improved by a speedup of up to 2.2 when running on an 8 core CPU.