Abstract:Intrusion Detection Systems (IDSs) play a crucial role in safeguarding network infrastructures from cyber threats and ensuring the integrity of highly sensitive data. Conventional IDS technologies, although successful in achieving high levels of accuracy, frequently encounter substantial model bias. This bias is primarily caused by imbalances in the data and the lack of relevance of certain features. This study aims to tackle these challenges by proposing an advanced machine learning (ML) based IDS that minimizes misclassification errors and corrects model bias. As a result, the predictive accuracy and generalizability of the IDS are significantly improved. The proposed system employs advanced feature selection techniques, such as Recursive Feature Elimination (RFE), sequential feature selection (SFS), and statistical feature selection, to refine the input feature set and minimize the impact of non-predictive attributes. In addition, this work incorporates data resampling methods such as Synthetic Minority Oversampling Technique and Edited Nearest Neighbor (SMOTE_ENN), Adaptive Synthetic Sampling (ADASYN), and Synthetic Minority Oversampling Technique–Tomek Links (SMOTE_Tomek) to address class imbalance and improve the accuracy of the model. The experimental results indicate that our proposed model, especially when utilizing the random forest (RF) algorithm, surpasses existing models regarding accuracy, precision, recall, and F Score across different data resampling methods. Using the ADASYN resampling method, the RF model achieves an accuracy of 99.9985% for botnet attacks and 99.9777% for Man-in-the-Middle (MITM) attacks, demonstrating the effectiveness of our approach in dealing with imbalanced data distributions. This research not only improves the abilities of IDS to identify botnet and MITM attacks but also provides a scalable and efficient solution that can be used in other areas where data imbalance is a recurring problem. This work has implications beyond IDS, offering valuable insights into using ML techniques in complex real-world scenarios.

A Machine Learning based Threat Intelligence Framework for Industrial Control System Network Traffic Indicators of Compromise

Leveraging Data Fitting and Trust Assessment to Improve the Security of Industrial Networks

DLTIF: Deep Learning-Driven Cyber Threat Intelligence Modeling and Identification Framework in IoT-Enabled Maritime Transportation Systems

Enhanced Anomaly Detection in Industrial Control Systems aided by Machine Learning

Survey on Intrusion Detection Systems Based on Machine Learning Techniques for the Protection of Critical Infrastructure

Using machine learning to detect network intrusions in industrial control systems: a survey

An Ensemble Deep Learning-based Cyber-Attack Detection in Industrial Control System

An Analytics Framework for Heuristic Inference Attacks against Industrial Control Systems

A Threat Hunting Framework for Industrial Control Systems

A Deep Learning-based Framework for Conducting Stealthy Attacks in Industrial Control Systems

Towards Low-Barrier Cybersecurity Research and Education for Industrial Control Systems

AI-based Identification of Most Critical Cyberattacks in Industrial Systems

Generative AI and Cognitive Computing-Driven Intrusion Detection System in Industrial CPS

Machine learning for intrusion detection in industrial control systems: challenges and lessons from experimental evaluation

Intrusion Detection Framework for Industrial Internet of Things Using Software Defined Network

A Review of Hybrid Cyber Threats Modelling and Detection Using Artificial Intelligence in IIoT

SmartSentry: Cyber Threat Intelligence in Industrial IoT

A Hierarchical Intrusion Detection System for Industrial Control Networks based on EtherNet/IP

IIDS: Design of Intelligent Intrusion Detection System for Internet-of-Things Applications

Modeling, Detecting, and Mitigating Threats Against Industrial Healthcare Systems: A Combined Software Defined Networking and Reinforcement Learning Approach

A Machine Learning-Based Framework with Enhanced Feature Selection and Resampling for Improved Intrusion Detection