Harnessing Machine Learning for Adaptive Signature-Based Network Intrusion Detection: A Simulation-Driven Approach

Network security is essential for data sharing on the internet. Traditional methods such as firewalls cannot detect fragmented packets and are often outmaneuvered by increasingly sophisticated attackers, resulting in productivity losses, financial damage, and reputational harm. This study investigates the use of machine learning (ML) models in developing effective intrusion detection systems (IDS) using signature-based methods. The research leverages the UNSW-NB15 dataset and compares four ML algorithms: K-Nearest Neighbor (KNN), Random Forest (RF), Bayesian Network (Bayes Net), and Decision Tree (J48), with feature reduction applied using Principal Component Analysis (PCA) to improve efficiency. The models were built and evaluated using the WEKA platform, with 10-fold cross-validation applied to assess accuracy, precision, recall, and F-measure. Results show that J48 significantly outperforms the other algorithms in terms of overall accuracy, while Bayes Net produces the least accurate results. These findings underscore the efficacy of J48 and Random Forest in signature-based IDS for network security.

Machine Learning, Intrusion Detection System, Signature-based IDS, UNSW-NB15, J48, Random Forest

1. W. Steingartner, D. Galinec, and A. Kozina, “Threat defense: Cyber deception approach and education for resilience in hybrid threats model,” Symmetry (Basel)., vol. 13, no. 4, pp. 1–25, 2021, doi: 10.3390/sym13040597. [Google Scholar] [Crossref]

2. A. V. Jatti and V. J. K. K. Sonti, “Intrusion Detection Systems: A Review,” Restaur. Bus., vol. 118, no. 7, pp. 50–58, 2019, doi: 10.26643/rb.v118i7.7246. [Google Scholar] [Crossref]

3. P. Panagiotou, N. Mengidis, T. Tsikrika, S. Vrochidis, and I. Kompatsiaris, “Host-based Intrusion Detection Using Signature-based and AI-driven Anomaly Detection Methods,” Inf. Secur. An Int. J., vol. 50, no. x, pp. 37–48, 2021, doi: 10.11610/isij.5016. [Google Scholar] [Crossref]

4. J. Ferdous, R. Islam, A. Mahboubi, and M. Z. Islam, “A Review of State-of-the-Art Malware Attack Trends and Defense Mechanisms,” IEEE Access, vol. 11, no. October 2023, pp. 121118–121141, 2023, doi: 10.1109/ACCESS.2023.3328351. [Google Scholar] [Crossref]

5. B. Lampe and W. Meng, “Intrusion Detection in the Automotive Domain: A Comprehensive Review,” IEEE Commun. Surv. Tutorials, vol. 25, no. 4, pp. 2356–2426, 2023, doi: 10.1109/COMST.2023.3309864. [Google Scholar] [Crossref]

6. T. U. Sheikh, H. Rahman, H. S. Al-Qahtani, T. Kumar Hazra, and N. U. Sheikh, “Countermeasure of Attack Vectors using Signature-Based IDS in IoT Environments,” 2019 IEEE 10th Annu. Inf. Technol. Electron. Mob. Commun. Conf. IEMCON 2019, pp. 1130–1136, 2019, doi: 10.1109/IEMCON.2019.8936231. [Google Scholar] [Crossref]

7. Stefanos Kiourkoulis, “DDoS Dataset - Use of machine learning to analyse intrusion detection performance,” Lulea Univ. Technol., p. 81, 2020, [Online]. Available: https://www.kaggle.com/devendra416/ddos-datasets/data [Google Scholar] [Crossref]

8. M. Zakariah, S. A. AlQahtani, and M. S. Al-Rakhami, “Machine Learning-Based Adaptive Synthetic Sampling Technique for Intrusion Detection,” Appl. Sci., vol. 13, no. 11, 2023, doi: 10.3390/app13116504. [Google Scholar] [Crossref]

9. J. P. Bharadiya, “A Tutorial on Principal Component Analysis for Dimensionality Reduction in Machine Learning,” Int. J. Innov. Res. Sci. Eng. Technol., vol. 8, no. 5, pp. 2028–2032, 2023, doi: 10.5281/zenodo.8002436. [Google Scholar] [Crossref]

10. N. Moustafa and J. Slay, “UNSW-NB15: A comprehensive data set for network intrusion detection systems (UNSW-NB15 network data set),” 2015 Mil. Commun. Inf. Syst. Conf. MilCIS 2015 - Proc., pp. 1–6, 2015, doi: 10.1109/MilCIS.2015.7348942. [Google Scholar] [Crossref]

11. I. Almomani and M. Alenezi, “Efficient Denial of Service Attacks Detection in Wireless Sensor Networks,” J. Inf. Sci. Eng., vol. 34, no. 4, pp. 977–1000, 2018, doi: 10.6688/JISE.201807_34(4).0011. [Google Scholar] [Crossref]

12. V. Kumar, A. K. Das, and D. Sinha, “UIDS: a unified intrusion detection system for IoT environment,” Evol. Intell., no. 0123456789, 2019, doi: 10.1007/s12065-019-00291-w. [Google Scholar] [Crossref]

13. U. Matthew, J. Kazaure, and N. Okafor, “Contemporary Development in E-Learning Education, Cloud Computing Technology & Internet of Things,” EAI Endorsed Trans. Cloud Syst., vol. 7, no. 20, p. 169173, 2021, doi: 10.4108/eai.31-3-2021.169173. [Google Scholar] [Crossref]

14. D. Singh and B. Singh, “Investigating the impact of data normalization on classification performance,” Appl. Soft Comput., vol. 97, no. xxxx, p. 105524, 2020, doi: 10.1016/j.asoc.2019.105524. [Google Scholar] [Crossref]

15. S. H. Huang, “Supervised feature selection: A tutorial,” Artif. Intell. Res., vol. 4, no. 2, 2015, doi: 10.5430/air.v4n2p22. [Google Scholar] [Crossref]

16. C. C. Aggarwal, “Educational and software resources for data classification,” Data Classif. Algorithms Appl., pp. 657–665, 2014, doi: 10.1201/b17320. [Google Scholar] [Crossref]

17. A. M. Rahmani et al., “Machine learning (Ml) in medicine: Review, applications, and challenges,” Mathematics, vol. 9, no. 22, pp. 1–52, 2021, doi: 10.3390/math9222970. [Google Scholar] [Crossref]

18. Rashmi Agrawal, “K-Nearest Neighbor for Uncertain Data,” Int. J. Comput. Appl., vol. 105, no. 11, pp. 13–16, 2014. [Google Scholar] [Crossref]

• Cyberverse: A Game-Based Learning Application for Cyber Security
• Design and Development of a Low Cost Smart Electronic School Bell
• Assessing the Effectiveness of TVET Training in Enhancing Youth Employability: A Case Study of Kisumu County, Kenya
• Social Penetration Analysis in Self-Disclosure of Online Loan Application Users to Their Partners
• Optimization of Maintenance Strategies in an Oil and Gas Production Facility to Minimize Maintenance Cost