Design of Network Intrusion Detection Systems with under-sampled datasets

Intrusion Detection Systems (IDS) are responsible for monitoring and detecting anomalies in computer networks. Currently, machine learning techniques have been employed in the development of IDs and the classifiers performance evaluation in intrusion detection systems is a critical task. Designers should evaluate a variety of classifiers in a timely manner and thus an approach that leverage the evaluation process and maintains performance and generalization capability is required. In this work, we use a data-driven approach based on an under- sampling technique to evaluate the performance of classifiers in the detection of network intrusion. We applied an under-sampling technique in two IDS datasets and evaluated the performance of 5 (five) classifiers in a 5% dataset portion followed by a validation step in a 2% portion of the same dataset without overlaps or repetitions. The results indicate that the use of a stratified train/test into under-sampled datasets show stability in the results in relation to the validation subsampling. The use of this approach allows us to evaluate the classifiers in reduced time, including those considered computationally costly.