Predictive Network Security Assessment using Risk Analysis and Random Forest

Traditional IDS can only classify the network traffic as either legitimate or malicious traffic without any significant information about how the security risk is progressing in the network before being successfully breached. There are many signs before the breach of the network like irregularities in communication, connection behavior, and repeated attempts at access. In this research paper, we have introduced RF-NRA (Random Forest Based Network Risk Assessment) which has reformulated the problem of network traffic classification as ordinal and progressive risk state estimation problem with the use of Random Forest. Six risk states of the network traffic based on intrusion categories (Normal, Probe, DoS, R2L, and U2R) are introduced, namely; SAFE, LOW RISK, MODERATE RISK, HIGH RISK, CRITICAL, and COMPROMISED. The system is trained and tested on the NSL-KDD dataset, obtaining a mean macro-F1 score on 5-fold cross-validation of 0.92 and a test set accuracy of 73.3%. We also report hyper-parameter sensitivity analysis, tier-wise ROC-AUC metrics, and the system architecture for online implementation. Our evaluation shows that there is a large generalization gap due to the presence of attack types exclusive to the test set, providing an empirical observation of the limitations of supervised classification methods in terms of their performance on novel attacks. Our ordinal risk-tier formulation, rather than increased accuracy, is our key contribution here.