Menu Close

An ensemble Models to detect intrusion using CIC-IDS-2017 and CIC-IDS-2018 as benchmarks

This paper is based on an in-depth discussion of a hybrid ensemble-based intrusion detection platform, using two popular benchmark datasets CIC-IDS-2017 and CIC-IDS-2018. The model proposed is a combination of six different machine learning algorithms, Logistic Regression, Naive Bayes, K-Nearest Neighbors, Support Vector Machines, Decision Trees and Random Forests, and a two-layer ensemble model that combines stacking and majority voting methods. The goal of this hybridization is to leverage the personal strengths of each classifier and alleviate some of their weaknesses by making decisions together. The effectiveness of the model was measured using the key performance measures of accuracy, precision, recall and F1-score. In experiments, it can be shown that the ensemble model surpasses each individual classifier in both datasets in terms of detection rate and false positive rate. Indicatively, for example the hybrid model achieved average accuracy of over 96, whereas one algorithm achieved a sub-90 average. The results reveal the robustness and adaptability of the ensemble learning to the different patterns of attacker and traffic behavior. Another testimony that the model can be applied to the cybersecurity sphere is the enormous generalization to datasets. In order to improve the performance of the system and the working efficiency in the dynamic network environment, further experimentation on how the features of deep learning, real-time traffic modeling, and periodic thresholding can be incorporated into the system will be addressed in the future.