The Implementation of Machine Learning for Optimizing Network-Based Intrusion Detection in the Snort Application

Along with the increasing need for computer and mobile applications, communication, and information over internet networks, the need for data security guarantees that must be provided to avoid data theft or other acts of intrusion also increases. An Intrusion Detection System (IDS) is a system developed by network administrators to protect the main network and company services from attempted intrusions both from inside and outside the network. In building an IDS, a complete dataset is needed, which describes the network conditions and the type of intrusion being described. However, a dataset has many features which can sometimes trigger classification errors. Therefore, feature selection is needed before building classification model using Random Forest and Decision Tree. This study has achieved the development of an intrusion classification model using the University of New South Wales-Network-Based 15 (UNSW-NB15) dataset to build an intrusion identification model using decision tree and random forest algorithm. Both algorithms had perform good performance in identifying the intrusions, but the Decision Tree (C45 algorithm) outperformed the Random Forest in terms of accuracy, yielding a superior model. Additionally, the derived models of Decision Tree model and Random Forest model were effectively integrated into the Snort application.