Abstract:Abstract Computer networks intrusion detection systems (IDSs) and intrusion prevention systems (IPSs) are critical aspects that contribute to the success of an organization. Over the past years, IDSs and IPSs using different approaches have been developed and implemented to ensure that computer networks within enterprises are secure, reliable and available. In this paper, we focus on IDSs that are built using machine learning (ML) techniques. IDSs based on ML methods are effective and accurate in detecting networks attacks. However, the performance of these systems decreases for high dimensional data spaces. Therefore, it is crucial to implement an appropriate feature extraction method that can prune some of the features that do not possess a great impact in the classification process. Moreover, many of the ML based IDSs suffer from an increase in false positive rate and a low detection accuracy when the models are trained on highly imbalanced datasets. In this paper, we present an analysis the UNSW-NB15 intrusion detection dataset that will be used for training and testing our models. Moreover, we apply a filter-based feature reduction technique using the XGBoost algorithm. We then implement the following ML approaches using the reduced feature space: Support Vector Machine (SVM), k-Nearest-Neighbour (kNN), Logistic Regression (LR), Artificial Neural Network (ANN) and Decision Tree (DT). In our experiments, we considered both the binary and multiclass classification configurations. The results demonstrated that the XGBoost-based feature selection method allows for methods such as the DT to increase its test accuracy from 88.13 to 90.85% for the binary classification scheme.

An Approach to Filter False Positive Alerts Based on RS-SVM Theory

Use of host's software information to mitigate false positive in signature-based NIDS

Pre-decision Detection Engine for Signature-Based Network Intrusion Detection System

Using Outlier Detection to Reduce False Positives in Intrusion Detection

A Novel Data Mining-Based Method for Alert Reduction and Analysis.

Alert reduction for network intrusion detection

Should I Raise The Red Flag? A comprehensive survey of anomaly scoring methods toward mitigating false alarms

An Automated Alert Cross-Verification System with Graph Neural Networks for IDS Events

A New Intelligent Intrusion Detection Method Based on Attribute Reduction and Parameters Optimization of SVM

Reduction on False Positive Rate of Anomaly IDS

Performance Analysis of Intrusion Detection Systems Using a Feature Selection Method on the UNSW-NB15 Dataset

Network Intrusion Detection Method Based on Rough Set Theory

An improved Harris Hawks optimizer based feature selection technique with effective two-staged classifier for network intrusion detection system

Survey of the Security Alerts Correlation Algorithms

Intrusion Detection With Deep Learning Classifiers: A Synergistic Approach of Probabilistic Clustering and Human Expertise to Reduce False Alarms

Enhancing Anomaly Detection Models for Industrial Applications through SVM-Based False Positive Classification

2-layer classification model with correlated common feature selection for intrusion detection system in networks

Attribute Weighting with Adaptive NBTree for Reducing False Positives in Intrusion Detection

Information-Theoretic Modeling of False Data Filtering Schemes in Wireless Sensor Networks

Impact of Feature Selection Methods on Data Classification for IDS

A Hybrid Visualizing Approach Based on Adaptive Neuro-fuzzy Inference System, Decision Tree, and K-means for Intrusion Detection