Method of Detection of Intrusions Based on Stacking Meta-Algorithm

An analysis of modern computer network intrusion detection systems was carried out. The application of machine and deep learning methods for classification problems has been investigated. The UNSW-NB15 dataset, developed at the Australian Cyber Security Center's (ACCS) Cyber Range Laboratory, contains data on normal network operations and synthetic intrusions. Data pre-processing was performed, including class balancing using the SMOTEENN method and selection of informative features using the Recursive Feature Elimination method. The possibility of using the stacking meta-algorithm to detect intrusions into computer networks has been investigated. A new algorithm for generating packets of raw data is proposed, which generates two sets of training data: one for training basic models, the other for a meta-model. A study of the effectiveness of using Random Forest, ANN, K Nearest Neighbor methods and Support Vector Machine and Random Forest as a decision-making meta-model was conducted. The use of the stacking meta-algorithm with the proposed algorithm for forming packets of output data, as well as basic models and a meta-model, led to a significant improvement in the quality of the model. It was found that, on average, recall and f1 score increased by 55.6% and 37.4%, respectively, compared to raw data and other models.