A comprehensive intrusion detection framework using boosting algorithms. (May 2022)

• Record Type: Journal Article
• Authors: Kilincer, Ilhan Firat; Ertam, Fatih; Sengur, Abdulkadir
• Is Part Of: Computers & electrical engineering. Volume 100(2022)
• Publication Date: 2022-05
• Subjects: IDS -- Boosting algorithms -- Extra tree algorithm -- Cyber security -- Machine learning; Computer engineering -- Periodicals; Electrical engineering -- Periodicals; Electrical engineering -- Data processing -- Periodicals; Ordinateurs -- Conception et construction -- Périodiques; Électrotechnique -- Périodiques; Électrotechnique -- Informatique -- Périodiques; Computer engineering; Electrical engineering; Electrical engineering -- Data processing; Periodicals; Electronic journals; 621.302854
• DOI: 10.1016/j.compeleceng.2022.107869
• Languages: English
• ISSNs: 0045-7906

Abstract

Highlights: A new cyber security intrusion detection dataset (CCiDD) has been created by performing various scenarios with today's widely used attack methods and internet applications. The most optimum features of the data sets have been selected with the extra tree algorithm in order to process the data received over the network quickly and successfully. The data sets were classified using high performance GBM, LGBM, XGBoost, catboost algorithms. Abstract: Intrusion Detection Systems are one of the most effective technologies that protect systems against cyber-attacks. In this study, a new Comprehensive Cyber Security Intrusion Detection Dataset (CCiDD) was created. The CCiDD_A and CCiDD_B datasets are derived from the created dataset. Two datasets were compared with the NSL-KDD, UNSW-NB15 and CSE-CIC-IDS2018 datasets. In the study, the most optimal features for all datasets were determined by the Extra Tree algorithm and the new sub-datasets were classified by machine learning methods with default parameters. As a result of the classification, LGBM and XGBoost algorithms were selected as the most successful algorithms. Hyper parameter optimization was applied to LGBM and XGBoost algorithms to increase classification performance. LGBM classifier surpassed XGBoost classifier in terms of performance and processing time. LGBM algorithm achieved performance values of 99.84%, 98.02%, 99.94%, 95.68% and 99.98% for NSL-KDD, UNSW-NB15, CSE-CIC-IDS2018, CCiDD_A and CCiDD_B datasets, respectively. Since detection time of attacks is a critical issue, the LGBM classifier is recommended for attack detection in terms of time and performance. Graphical abstract: Image, graphical abstract