Performance Analysis of Machine Learning Techniques in Detecting Multi-intrusion Attacks

Abstract

Abstract The sophistication of network intrusion techniques presents significant challenges as to timeliness and accuracy of detection. Building on The University of Nevada Reno (UNR) Intrusion Detection Dataset (IDD), we explore the efficacy of Machine Learning (ML) techniques. The Light Gradient-Boosting Machine (LightGBM) model has an accuracy score of 0.992 and a precision of 0.99. The Extra Gradient Boost (XGBoost) and the Extremely Randomized Trees (Extra Tree) models obtain an accuracy of 0.985 and precision of 0.99. The CatBoost model (a version of Gradient Boosted Decision Trees or GBDT) has an accuracy of 0.975 and a precision of 0.98. These results are better than those of previous studies using the same data set. We also find that attacks of the type "Overflow" and "PortScan" are more likely to be detected by ML techniques than "TCP-SYN" type. Our results show the promise of using ML techniques in the realm of cybersecurity management.