Harnessing Machine Learning for Adaptive Signature-Based Network Intrusion Detection: A Simulation-Driven Approach

Abstract

Network security is essential for data sharing on the internet. Traditional methods such as firewalls cannot detect fragmented packets and are often outmaneuvered by increasingly sophisticated attackers, resulting in productivity losses, financial damage, and reputational harm. This study investigates the use of machine learning (ML) models in developing effective intrusion detection systems (IDS) using signature-based methods. The research leverages the UNSW-NB15 dataset and compares four ML algorithms: K-Nearest Neighbor (KNN), Random Forest (RF), Bayesian Network (Bayes Net), and Decision Tree (J48), with feature reduction applied using Principal Component Analysis (PCA) to improve efficiency. The models were built and evaluated using the WEKA platform, with 10-fold cross-validation applied to assess accuracy, precision, recall, and F-measure. Results show that J48 significantly outperforms the other algorithms in terms of overall accuracy, while Bayes Net produces the least accurate results. These findings underscore the efficacy of J48 and Random Forest in signature-based IDS for network security.