Improving Intrusion Detection System on Servers using Machine Learning-Based RFERF Technique

Intrusion Detection Systems (IDS) are essential for network security, but they also come with several critical security issues that can affect their effectiveness and reliability. One of the critical issues in IDS is the emergence of false positives in detection results. An IDS might incorrectly identify legitimate activities as malicious, leading to unnecessary alerts. It can overwhelm security teams with false alarms, causing alert fatigue and potentially causing real threats to be overlooked. In addition, IDS performance does not achieve maximum accuracy in detecting attacks. Therefore, to address this problem, this research proposes a machine learning-based system security model called RFERF (Recursive Feature Elimination with Random Forest). This model was built with two levels of technical approaches simultaneously: a strategy at the data level and an approach at the algorithm level. At the data level, RFE-based feature selection techniques are applied to obtain the best subset of the dataset. Meanwhile, the approach at the algorithm level applies the Random Forest (RF) algorithm as a classifier in the detector engine. Then, the proposed model is tested and validated using the CIC-IDS2017 dataset. The model's performance is evaluated through a confusion matrix by calculating the accuracy, recall, precision, f1-score, kappa score values, and testing time. The experimental results show that the proposed model (RFERF) can outperform other models. The accuracy obtained is 99.95%. However, a limitation of this model is its slower speed compared to the Random Forest (RF) model, which operates at 613ms, while RFERF takes 1.190ms. In future research, we aim to enhance the model's performance to optimize its speed. Process speed has implications for IDS performance in detecting attacks.