An empirical evaluation of preprocessing methods for machine learning based network intrusion detection systems

Despite extensive efforts in developing machine learning-based Network Intrusion Detection Systems, inconsistencies in the choice of pre-processing of training data exists across the literature. This study surveys both seminal and recent works, identifying that while the same benchmark datasets and model classes are frequently used, the data pre-processing methods vary significantly, often without in-depth discussion and justification, limiting performance and hindering fair comparison. This work aims to address this problem, by exploring the possibility of a standardised pre-processing for Network Intrusion Detection Systems benchmark datasets We perform a detailed experimental evaluation on the most common machine learning models and four prevalent Network Intrusion Detection Systems benchmark datasets, considering a total of 72 combinations of pre-processing methods for both numerical and categorical fields in the network flow data. Based on our experimental evaluation, we propose a uniform (or ’standardised’) data pre-processing approach, which consistently performs well across the considered datasets and machine learning models. We demonstrate that our proposed method can achieve up to a 11% increase in detection accuracy over commonly applied pre-processing techniques for a shallow neural network (for the purposes of this work, we deem networks with fewer than 3 hidden layers as shallow), versus less-optimal pre-processing approaches. To facilitate future research, we make our code publicly available 1 1 https://github.com/liamdm/StandardisedNIDSPreprocessing . .