Performance evaluation of machine learning algorithms for intrusion detection

Abstract

In the cyber security domain, the increasing sophistication of attacks requires the development of improved detection techniques. This research looked at the usefulness of machine learning methods, especially Decision Tree, Support Vector Machine (SVM), Random Forest, and Naive Bayes, in intrusion detection. The aim of the study was to use these techniques to train data sets using the KDD Cup 99 data set and the Python programming language for validation. Performance evaluations were carried out to examine accuracy, precision, recall, and F1 score, giving insight on the strengths and drawbacks of each algorithm. The investigation also examined the impact of Decision Tree, SVM, Random Forest, and Naive Bayes on intrusion detection, taking into consideration data sets and feature counts to assess the effectiveness of each model. The study addressed pertinent aspects, including the comparative performance of different algorithms, their suitability for diverse types of intrusions, and the factors that influence their efficacy. Traditional intrusion detection methods frequently fail to detect modern attacks, resulting in high false-positive and false negative rates. Machine learning algorithms, on the other hand, took a more dynamic approach, and this study aimed to elucidate their performance characteristics. This study contributed to the evolving landscape of intrusion detection by delving into the complexities of Decision Tree, SVM, Random Forest, and Naive Bayes, providing insights that could inform cyber security strategies and fortify defences against emerging cyber threats. According to our findings, the SVM and Random Forest models outperformed the Decision Tree and Naive Bayes models in terms of overall accuracy and ability to classify various types of intrusion. Random Forest, in particular, outperformed all other classes, making it a strong candidate for intrusion detection in this context. On average, it achieved higher precision, recall, and F1-Score and performed well across various types of intrusion.