Fuzzifying Intrusion Detection Systems with Modified Artificial Bee Colony and Support Vector Machine Algorithms

Corporate networks are popular targets for hackers, either to be spied on, steal trade secrets or to extort money by encrypting data. Possible safeguards are intrusion detection systems (IDS) which try to detect attacks by analyzing network traffic. This traffic is inherently vague and usually can not be classified unambiguously into attacks or normal data flow. A fuzzy classification system creates a more accurate representation by using membership degrees for the sets of attack data and normal data. However, research combining IDS and fuzzy architecture has been minimal. This paper explores a fuzzy approach to IDS. We give a comprehensive overview of recent studies, analyze how those solutions were built and compare them using the metrics accuracy, detection rate and false alarm rate. We further propose two new IDS models: One using a fuzzy Artificial Bee Colony and the other the Intuitionistic Fuzzy Twin Support Vector Machine algorithm. The two models and their combination are benchmarked by classifying the test data sets KDD99, NSL-KDD, UNSW-NB15 and CSE-CIC-IDS2018 and then compared to the studies from our literature review. Our results show that they can produce comparable results and more transparency when detecting attack patterns in network traffic. This suggests that fuzzy engineering could contribute to creating more resilient IDS.