A Study on Network Anomaly Detection Using Stacking-Based Machine Learning Algorithms for ASNM Datasets

Detecting and analyzing the root cause of network traffic log problems is a labor-intensive and time-consuming operation, particularly for previously undiscovered failure patterns. To identify malicious logs from the advanced security network metrics datasets, our proposed solution is based on a stacking mechanism. According to training data input, there have been roughly three orthogonal approaches to developing intrusion detectors: (1) Detection based on knowledge, which models and matches the characteristics of malicious intrusions, (2) Detection based on anomalies, which models normal behavior and identifies deviations, and (3) Detection based on classification, which concurrently models dangerous and acceptable behavior. In the case of unknown or zero-day assaults evading detection, these strategies have a high false-negative rate, need extensive training and profiling, and are vulnerable. To overcome these problems, our proposed work is based on a stacking model, in which we deployed four machine learning algorithms, one at a time at level 1 and the other at level 0 for a better rate of testing accuracy. The performance of these approaches is relatively comparable, with Naive Bayes being the most effective at level 1 and support vector machines, decision tree, and K-nearest neighbor at level 0.