Comparative Study of Machine Learning Techniques for Intrusion Detection on CICIDS-2017 Dataset

Cyber-attacks are becoming more sophisticated and complicated, making it increasingly difficult to detect intrusions accurately. Intrusions have the potential to compromise data security, integrity, and availability, with serious consequences for individuals, organizations, and society as a whole. Several intrusion detection approaches have been presented to overcome this issue. These intrusion detection systems utilize classification algorithms to classify cyber security threats; however, due to the massive amount of data, many classification algorithms are unable to detect attacks accurately. Using feature selection/dimensional reduction approaches, data can be efficiently reduced and precisely recognized. The primary motive of this research is to examine multiple approaches used in anomaly detection based on ML (Machine Learning) algorithms. For every approach, we examined the performance of classifiers on CICIDS-2017 (Canadian Institute for Cybersecurity Intrusion Detection Set 2017) dataset using various feature selection/dimension reduction techniques. The data was preprocessed to remove unnecessary features whose contribution is negligible in detecting attack classes before the training or testing phase. The best algorithm for a particular attack class was finally determined by comparing accuracy of the overall model for various attack classes, including Distributed Denial of Service (DDoS), Denial of Service (DOS), Web-based, Brute force, intrusions, scans, Bots, and Heartbleed. The outcome demonstrated that, with an accuracy of 99.91%, the XGBoost classifier with Boruta feature selection outperformed the other classifiers.