Network intrusion detection based on machine learning strategies: performance comparisons on imbalanced wired, wireless, and software-defined networking (SDN) network traffics

Authors

HİLAL HACILARFollow
ZAFER AYDINFollow
VEHBİ ÇAĞRI GÜNGÖRFollow

Author ORCID Identifier

HİLAL HACILAR: 0000-0002-5811-6722

DOI

10.55730/1300-0632.4091

Abstract

The rapid growth of computer networks emphasizes the urgency of addressing security issues. Organizations rely on network intrusion detection systems (NIDSs) to protect sensitive data from unauthorized access and theft. These systems analyze network traffic to detect suspicious activities, such as attempted breaches or cyberattacks. However, existing studies lack a thorough assessment of class imbalances and classification performance for different types of network intrusions: wired, wireless, and software-defined networking (SDN). This research aims to fill this gap by examining these networks’ imbalances, feature selection, and binary classification to enhance intrusion detection system efficiency. Various techniques such as SMOTE, ROS, ADASYN, and SMOTETomek are used to handle imbalanced datasets. Additionally, eXtreme Gradient Boosting (XGBoost) identifies key features, and an autoencoder (AE) assists in feature extraction for the classification task. The study evaluates datasets such as AWID, UNSW, and InSDN, yielding the best results with different numbers of selected features. Bayesian optimization fine-tunes parameters, and diverse machine learning algorithms (SVM, kNN, XGBoost, random forest, ensemble classifiers, and autoencoders) are employed. The optimal results, considering F1-measure, overall accuracy, detection rate, and false alarm rate, have been achieved for the UNSW-NB15, preprocessed AWID, and InSDN datasets, with values of [0.9356, 0.9289, 0.9328, 0.07597], [0.997, 0.9995, 0.9999, 0.0171], and [0.9998, 0.9996, 0.9998, 0.0012], respectively. These findings demonstrate that combining Bayesian optimization with oversampling techniques significantly enhances classification performance across wired, wireless, and SDN networks when compared to previous research conducted on these datasets.

Keywords

Network intrusion detection systems (NIDS), network anomaly detection, deep learning, Bayesian optimization, class imbalance, software-defined networking (SDN)

First Page

623

Last Page

640

Creative Commons License

This work is licensed under a Creative Commons Attribution 4.0 International License.

Recommended Citation

HACILAR, HİLAL; AYDIN, ZAFER; and GÜNGÖR, VEHBİ ÇAĞRI (2024) "Network intrusion detection based on machine learning strategies: performance comparisons on imbalanced wired, wireless, and software-defined networking (SDN) network traffics," Turkish Journal of Electrical Engineering and Computer Sciences: Vol. 32: No. 4, Article 9. https://doi.org/10.55730/1300-0632.4091
Available at: https://journals.tubitak.gov.tr/elektrik/vol32/iss4/9