Comparative analysis of tree-based intrusion detection modelling and machine learning classification models using cyber-security dataset

Abstract

Cybersecurity has become an ever-pressing concern in the modern digital landscape, demanding robust and efficient intrusion detection systems. In this research, we conducted a comparative analysis of tree-based intrusion detection modelling and several popular machine learning classification models, using the widely used KDD99 dataset. To enhance the efficiency of the proposed model, we employ a hybrid feature selection method that combines the Gini index and information gain and incorporates them using the concepts of a decision tree (DT). Models under evaluation include DT, Support Vector Machine (SVM), K-Nearest Neighbours (KNN), and Logistic Regression (LR). We present a comprehensive evaluation of these models based on various performance metrics, including accuracy, F1 score, confusion matrix, precision, recall, and execution time. The dataset is meticulously pre-processed to eliminate noise and address any biases that may affect the results. The findings of this research reveal important insights into the strengths and weaknesses of different intrusion detection models. Our analysis sheds light on the performance variation between the tree-based model and SVM, KNN, and LR. In addition, we discuss the factors that contribute to the observed effectiveness of the model. The results demonstrate the effectiveness of the hybrid feature selection approach in enhancing the performance of tree-based models. In addition, we identify the most suitable models for specific performance criteria, guiding practitioners in selecting the appropriate model for their specific intrusion detection requirements. The results of this study contribute significantly to the advancement of intrusion detection techniques and provide valuable guidance to cybersecurity practitioners and researchers. The research highlights potential areas for further investigation and improvement, paving the way for more efficient and accurate intrusion detection systems in the future.