Understanding Machine Learning Model Behavior for Intrusion Detection Across Attacks

With the growing volume and variety of network traffic driven by various applications such as real-time communications and cloud services, combined with the increasing sophistication and frequency of malicious attempts, network administrators are facing greater challenges in securing their networks against malware. Over the past two decades, advances in machine learning and deep learning have led to a growing number of proposals for intelligent Network Intrusion Detection Systems (NIDS) that leverage these models to detect the unauthorized entry of security threats into the network. Existing studies focus on improving model accuracies, without a closer analysis of the underlying characteristics of the data. In this work, we analyze the effectiveness of NIDS mechanisms in different scenarios using different machine learning models. By examining classification performance across various data distributions -including scenarios with and without normal traffic and cases addressing class imbalance- we identify patterns in model behaviors and their correlation with attack characteristics. In our experiments, we have observed, (i) the kNN algorithm achieved the fastest training and testing times while maintaining adequate accuracy, (ii) XGBoost performed best in detecting the most commonly occurring attacks, (iii) MLP provided the highest improvement in minority class labels when resampling was applied in the dataset, and (iv) notably, while Reconnaissance attacks were consistently detected even with limited samples, detection of DoS attacks remained challenging with all models. We believe NIDS systems could benefit from the insights raised in this work based on the interplay between attack behaviors, data distributions, and model characteristics.