A Novel Two-Stage Classification Architecture Integrating Machine Learning and Artificial Immune System for Intrusion Detection on Balanced Dataset

Effective intrusion detection in cybersecurity is crucial, and previous studies have investigated many approaches, such as Machine Learning (ML), Deep Learning (DL), and blockchain principles. Nevertheless, due to the constant evolution of invaders’ tactics, there is a persistent need for up-to-date intrusion detection technologies. To construct a proficient Intrusion Detection System (IDS), it is necessary to assess several attack types. However, the presence of unbalanced datasets in this field often results in inadequate IDS performance. This work aims to rectify the imbalance problem by implementing Random Oversampling on a subset of the unbalanced CSE_CIC_IDS_2018 dataset. Three novel classification methods are introduced to evaluate the influence of balanced data on accuracy. The first two models use SVM-RFE and RF-RFE for the purpose of eliminating features, Dendritic Cell Algorithm (DCA) for refining attributes, and either SVC or RF for classification. The third model employs Adaboost-RFE for the purpose of feature extraction, and Adaboost for classification. The study emphasizes the impact of dataset balance and the use of DCA on the overall effectiveness, showcasing the proficiency of the presented models in detecting intrusions.