Design Approaches of Intrusion Detection Systems using Ensembling Algorithms

Intrusion Detection Systems are very important when it comes to monitoring network traffic, so fast and efficient analysis of these malicious network attacks can be a challenging task especially dealing with sophisticated cyberattacks with large amount of network traffic owing from one host to another. So proper validation and classification of these intrusions is very important. Many machine learning algorithms are present that can be used in classification of these intrusions but not all of them are good enough, every algorithm has their own limitations and many tools are incapable of handling such large chunks of data. This research is focused on dealing with intrusion attacks by using modern machine learning Ensembling approaches. The study is divided into three approaches first one involves using clustering algorithms, second one is focused on detecting each attack individually and the third approach consists of Ensembling these approaches and compare the results. On top of that, our classifier has been tested using Apache Sparks machine learning libraries with PySpark. All the experiments are carried on NSL-KDD data set which consists of many network intrusions. With our approach, we managed to get accuracy of around 92% and detection rate of 99%