Reinforcing Cyber Security: Defensive Machine Learning based Intrusion Detection System for NSL-KDD

In the world of digital transformation, intrusion detection has proven to be valuable in protecting the assets of organizations. In this paper, we propose a new machine learning-based technique; Random Forest (RF) to be implemented as intrusion detection system (IDS), to act as defensive frontier for organizations. However, creating an efficient IDS faces a number of challenges, these challenges summarizes in accuracy (mirrored as false positive rate) and training time. Choosing the right machine learning classifier, to work with the right type of network data is important. Detection accuracy can be enhanced by tuning the classifier towards optimal variables. While, training time can be enhanced by correct pre-processing of network data and selecting the features that are most dominant in correlation with the desired output. We examined several machine learning techniques, we applied several data pre-processing steps on NSL-KDD, also, hyper parameter tuning (manipulation) was performed to optimize classifier performance, finally, feature selection techniques were utilized to reduce training time and enhance overall performance. Random Forest has proven to be the most effective machine learning classifier to be used with NSL-KDD, we achieved the highest accuracy of 99.7% and training time of 30.25 second using only 7 features.