Optimized SVM - Based Network Anomaly Detection with Genetic Algorithm and Recursive Feature Elimination

Network anomaly detection is a critical task in cybersecurity which aims to identify unusual patterns and potential threats in network traffic. Existing solutions often rely on machine learning (ML) algorithms, including support vector machines (SVMs). However, traditional SVMs with fixed kernels may struggle to capture complex, non-linear relationships in network data, leading to suboptimal detection performance. Additionally, selecting the right hyperparameters is often a non-trivial task. In this paper, we investigate the application of SVMs with varying kernels (linear, sigmoid, polynomial, and radial basis function (RBF)) for network anomaly detection. We extend our exploration to RBF kernel optimization using genetic algorithm (GA) to fine-tune critical hyperparameters (C and Gamma). Concurrently, we integrate recursive feature elimination (RFE) for optimal feature selection, enhancing the model's discriminatory prowess. To evaluate our proposed method, our study encompasses a standard dataset of over 40,000 training instances and 40+ features, subjected to meticulous preprocessing. Rigorous evaluation using 10-fold cross-validation was performed culminating in a final validation on a distinct test dataset. Our empirical results show the supremacy of the GA-RBF-SVM model, driven by GA-optimized hyperparameters, in conjunction with RFE compared to the other SVM variants. This configuration achieves exceptional performance with 99.39% accuracy on validation data and 99.46% on the test dataset. Additionally, our study extends to advanced (ensemble) ML techniques all demonstrating exceptional performance benchmarks. This study demonstrates that with systematic parameter optimization and appropriate feature selection, RBF-kernel based SVMs can perform competitively in network anomaly detection compared to advanced machine learning schemes.