Combining Multiple Supervised Machine Learning Algorithms to Detect Network Intrusion Attempts

Abstract

The importance of using machine learning algorithms has emerged in many areas, including intrusion detection for networks and cyber systems. Conventional network monitoring systems approaches to detecting anomalies can be classified into two main categories: misuse detection and anomaly detection. Misuse detection (signature based) methods are intended to recognize known attack patterns in packets that matches their database of signatures representing known security threats. While Anomaly detection (behavior based) focuses on detecting unusual activity patterns. This is done by establishing a user behavior profile over a period, then certain parameters are stored, where any unfamiliar behavior appears from the user is considered anomaly. However, these systems suffer from producing a high rate of false alarms. Therefore, this study presents an improved approach utilizing combined multiple supervised machine learning classification methods, Random Forest, Gradient Booting Trees, K-nearest neighbor, and Logistic Regression, to increase the likelihood of the accurate detection of anomaly events, decreasing the rate of false-positive alarms.