Machine Learning Approaches for Effective Intrusion Detection Systems
摘要
Intrusion Detection Systems (IDS) are critical for safeguarding network infrastructures against various cyberattacks. While many researchers have shown that Machine Learning (ML)-based IDS can identify malicious traffic in synthetic datasets, few have evaluated their performance against real-world network traffic. This paper explores the impact of preprocessing techniques on model performance and evaluates how well an IDS trained on a synthetic dataset performs in real-world settings. We propose that incorporating a Local Baseline Profile (LBP) during training improves model performance. Our experiments include dataset size reduction, SMOTE oversampling, attack class grouping, dataset scaling, and feature reduction. We created multiple IDS models using the best preprocessing combinations and tested them against locally captured network traffic, containing both benign and attack traffic. Our findings show that adding LBP during training significantly improved detection rates for Decision Tree and Random Forest models in Brute Force attacks. However, our proposed IDS has limitations in detecting a wider range of network attacks, especially more complex and unseen ones. This highlights the need for enhanced training data, advanced feature extraction techniques, and adaptive learning models to improve IDS performance.