An optimized ensemble prediction model using AutoML based on soft voting classifier for network intrusion detection. (March 2023)

• Record Type: Journal Article
• Authors: Khan, Murad Ali; Iqbal, Naeem; Imran, ; Jamil, Harun; Kim, Do-Hyeun
• Is Part Of: Journal of network and computer applications. Volume 212(2023)
• Publication Date: 2023-03
• Subjects: Network intrusion detection -- Machine learning -- Automated learning -- Soft voting -- Ensemble learning; Microcomputers -- Periodicals; Computer networks -- Periodicals; Application software -- Periodicals; Micro-ordinateurs -- Périodiques; Réseaux d'ordinateurs -- Périodiques; Logiciels d'application -- Périodiques; Application software; Computer networks; Microcomputers; Periodicals; 004.05; 004
• DOI: 10.1016/j.jnca.2022.103560
• Languages: English
• ISSNs: 1084-8045

Abstract

Abstract: Traditional ML based IDS cannot handle high-speed and ever-evolving attacks. Furthermore, these traditional IDS face several common challenges, such as processing large amounts of network profiling data, low accuracy and detection rates, and data imbalance. Therefore, there is an immense demand for a security system for multi-purpose network applications to mitigate intrusion in network profiling data to protect users' privacy and property across the Internet. This study presents an OE-IDS model using AutoML based on a soft voting method for detecting intrusion in the network environment. The proposed study uses an AutoML framework to select optimal supervised classifiers for developing an optimal ensemble strategy using a soft voting method to maximize accuracy and minimize false alarm rates. Furthermore, our proposed study uses different sampling methods to extend data to solve the problem of data imbalance and minority classes. In addition, our proposed OE-IDS is validated using two benchmark datasets, such as UNSWNB15 and CICIDS2017, to achieve a higher detection rate. Both original and re-sampled data samples are considered to validate the proposed OE-IDS to ensure the generalizability and stability of the proposed OE-IDS model. The performance assessment shows that the proposed OE-IDS model detects intrusions with high accuracy in the network intrusion environment. The detection rate of the OE-IDS model based on reduced features set for UNSWNB15 and CICIDS2017 is 0.98% and 0.973%, respectively. Moreover, our proposed model is compared with conventional ML-based IDS; it is found that our proposed OE-IDS has produced higher accuracy and better detection rate. Highlights: Develop an OE-IDS model based on optimal learners using AutoML and soft-voting methods. Develop preprocessing module to resolve null values and data imbalance issues. Reduce feature space based on correlation index to minimize computational costs. Provide a detailed case study based on UNSW-NB15 and CICIDS2017 datasets. Presents a comprehensive analysis as a proof of concept of the proposed OE-IDS. Compare the detection rate of the OE-IDS with baseline discriminative and heuristic models.