An AutoML-Based Approach for Network Intrusion Detection

Network intrusion detection (NID) is a crucial cybersecurity measure for detecting unauthorized access and malicious activity. Traditional signature-based detection is highly accurate for known threats but struggles with zero-day attacks, requires frequent updates, and suffers performance issues as its database grows. Machine learning (ML) improves NID by identifying both known and unknown threats without constant updates, adapting to evolving cyber risks. However, traditional ML methods rely on manual processes, making them complex, less efficient for large-scale data, and prone to lower accuracy and false alarms. In this paper, we evaluate AutoML frameworks for network intrusion detection, developing automated algorithms to enhance performance, reduce false positives, and eliminate manual feature selection, while comparing them to traditional machine learning using the NSL-KDD dataset. Experiments on the NSL-KDD dataset demonstrate that while gradient boosting models (XGBoost, CatBoost) surpass bagging-based methods (Random Forest, LightGBM) with 80% accuracy, AutoML frameworks further improve detection capabilities through automated hyperparameter optimization and model selection, with H2O AutoML and MLJar achieving the highest accuracy of 90%, significantly outperforming FLAML (79%) and traditional models. These findings underscore AutoML's potential to optimize intrusion detection, improve detection robustness, and provide scalable, adaptive cybersecurity solutions.