Design and Analysis of an Effective Architecture for Machine Learning based Networks Intrusion Detection Systems

Abstract

ABSTRACT : Intrusion detection systems (IDS) are a crucial component of cybersecurity. Their primary function is monitoring network traffic to identify and flag any instances of hostile activity. In contemporary times, the efficacy of conventional intrusion detection systems (IDS) has been called into question due to the exponential proliferation of internet use, thus giving rise to a surge in novel forms of cyber assaults. Machine learning (ML) techniques have emerged as a viable alternative to augmenting conventional intrusion detection systems (IDS). This study will examine the variations in traffic received by Network Intrusion Detection Systems (NIDS) due to their installation in distinct subnetworks within an organization. In several instances, it is seen that a single assailant may direct their efforts towards different servers belonging to various organizations. This behavior is often perceived by intrusion detection systems (IDS) as infrequent attacks, thus diminishing the effectiveness of detection The objective is to develop a machine learning-driven IDS model capable of identifying and flagging potentially harmful network traffic received across various interfaces within organizational networks. The proposed approach involves the establishment of a centralized proxy server that will act as the recipient of all incoming traffic directed toward the organization's servers. This proxy server will be equipped with a multi-model IDS designed to analyze the traffic load. Upon analysis, the proxy server will then redirect the traffic to the appropriate requested server. The project has two primary objectives: the construction of an architecture that guarantees a comprehensive perspective and the examination of incoming traffic diverted toward the servers of various organizations. The development of a machine learning anomaly-based IDS with a high level of accuracy and detection rate. The ML-based IDS under consideration will be evaluated alongside other models suggested in existing literature studies, with a focus on assessing their respective accuracy percentages and detection rates. The evaluation of the proposed IDS involved the use of three distinct datasets: the CIC-MalMem-2022, CIC-IDS-2018, and CIC-IDS-2017. The XGBoost model demonstrated exceptional performance in terms of rapid detection, achieving accuracy rates of 99.96%, 99.73%, and 99.84% for the CIC-MalMem-2022, CIC-IDS-2018, and CIC-IDS-2017 datasets, respectively. These impressive results were obtained within very short time intervals of 0.01 seconds, 0.03 seconds, and 0.04 seconds, respectively. The stacking model has the highest level of accuracy among the evaluated models. Specifically, it achieves an accuracy of 99.98% for the CIC-MalMem-2022 dataset, 99.61% for the CIC-IDS-2018 dataset, and 99.86% for the CIC-IDS-2017 dataset. The IDS that was developed. Demonstrated superior accuracy and time detection outcomes in comparison to previous research in the field.