Intrusion Detection System (IDS) For Network Traffic Analysis Using Machine Learning Models

Abstract

Intrusion Detection Systems (IDS) are an important element of cyber security design since they help in discovering and countering vulnerability in internet traffic on networks. Traditional detection methods often fall short of identifying new threats, notably those associated with zero-day attacks. Therefore, the current project takes a Machine Learning (ML) approach focused on identifying patterns of behavior, or typical activity in the network while picking up on malicious behavior to change the overall normality (anomaly detection). The CICIDS2017 dataset was selected because it reflects typical situations that represent internet traffic. Once through a subsequent round of preprocessing, both supervised learning models consisting of logistic regression and random forest, along with a hybrid model of isolation forest, as an unsupervised learning component, were performed to reduce any inconsistencies during preprocessing and during the data processing phase. A real-time simulation was then performed and displayed through a dynamic dashboard interface to view the system's response time and visualize abnormalities as they arose in each instance of simulated traffic. The results indicated improved accuracy in identifying the anomaly of behavior of the disease and reducing false positives as a result of incorporating deep learning techniques. These findings highlight potential for ML to help in the entire scope of cyber security.