DETECTION OF NETWORK INTRUSIONS USING MACHINE LEARNING ALGORITHMS AND FUZZY LOGIC

Abstract

The study proposed a model of an intrusion detection system based on machine learning using feature selection in large data sets based on ensemble learning methods. Statistical tests and fuzzy rules were used to select the necessary features. When choosing a basic classifier, the behavior of 8 machine learning algorithms was investigated. The proposed system provided a reduction in intrusion detection time (up to 60%) and a high level of attack detection accuracy. The best classification results for all studied datasets were provided by tree-based classifiers: DesignTreeClassifier, ExtraTreeClassifier, RandomForestClassifier. With the appropriate setting, choosing Stacking or Bagging classifier for model training using all data sets provides a small increase in the classification accuracy, but significantly increases the training time (by more than an order of magnitude, depending on the base classifiers or the number of data subsets). As the number of observations in the training dataset increases, the effect of increasing training time becomes more noticeable. The best indicators in terms of learning speed were provided by the VotingClassifier, built on the basis of algorithms with maximum learning speed and sufficient classification accuracy. The training time of the classifier using FuzzyLogic practically does not differ from the training time of the voting classifier (approximately 10-15% more). The influence of the number of features on the training time of the classifiers and the VotingClassifier ensemble depends on the behavior of the base classifiers. For ExtraTreeClassifier, the training time is weakly dependent on the number of features. For DesignTree or KNeibors (and, as a result, for the Voting classifier in general), the training time increases significantly with the increase in the number of features. Reducing the number of features on all datasets affects the estimation accuracy according to the criterion of average reduction of classification errors. As long as the group of features in the training dataset contains the first in the list of features with the greatest influence, the accuracy of the model is at the initial level, but when at least one of the features with a large influence is excluded from the model, the accuracy of the model drops dramatically.