Enhancing Network Threat Detection with Random Forest-Based NIDS and Permutation Feature Importance

Abstract Network Intrusion Detection Systems (NIDS) are critical for protecting computer networks from unauthorized activities. Traditional NIDS rely on rule-based signatures, which can be limiting in detecting emerging threats. This study investigates the effectiveness of the random forest classifier in advancing NIDS capabilities through machine learning. Using the CICIDS-2017 dataset, the data are preprocessed to enhance their quality by removing redundancies. feature selection and permutation importance were employed to identify the most relevant features. The methodology involves rigorous testing and analysis of the random forest classifier’s performance, focusing on f1-score rates compared to other machine learning models. Results demonstrate that by optimizing class weights, applying a custom prediction function and leveraging 26 key features, the random forest classifier achieves an outstanding 99.8% in the weighted f1-score and 93.31% in the macro f1-score in various attack types. This research highlights the potential of machine learning to significantly enhance NIDS effectiveness, offering a robust defense mechanism against evolving cybersecurity threats in modern networks.