The security of networked systems has become a critical universal issue that influences individuals, enterprises and governments. The rate of attacks against networked systems has increased dramatically, and the tactics used by the attackers are continuing to evolve. Intrusion detection is one of the solutions against these attacks. A common and effective approach for designing Intrusion Detection Systems (IDS) is Machine Learning. The performance of an IDS is significantly improved when the features are more discriminative and representative. This study uses two feature dimensionality reduction approaches: (i) Auto-Encoder (AE): an instance of deep learning, for dimensionality reduction, and (ii) Principle Component Analysis (PCA). The resulting low-dimensional features from both techniques are then used to build various classifiers such as Random Forest (RF), Bayesian Network, Linear Discriminant Analysis (LDA) and Quadratic Discriminant Analysis (QDA) for designing an IDS. The experimental findings with low-dimensional features in binary and multi-class classification show better performance in terms of Detection Rate (DR), F-Measure, False Alarm Rate (FAR), and Accuracy. This research effort is able to reduce the CICIDS2017 dataset’s feature dimensions from 81 to 10, while maintaining a high accuracy of 99.6% in multi-class and binary classification. Furthermore, in this paper, we propose a Multi-Class Combined performance metric $Combine{d}_{Mc}$ with respect to class distribution to compare various multi-class and binary classification systems through incorporating FAR, DR, Accuracy, and class distribution parameters. In addition, we developed a uniform distribution based balancing approach to handle the imbalanced distribution of the minority class instances in the CICIDS2017 network intrusion dataset.

Recently, cybersecurity threats have increased dramatically and the techniques used by the attackers continue to evolve and become ingenious during the attack. Moreover, the complexity and frequent occurrence of imbalanced class distributions in most datasets indicate the need for extra research efforts. The objective of this paper is to utilize various techniques for handling imbalanced datasets to build an effective intrusion detection system from the up-to-date CIDDS-001 dataset. The effectiveness of sampling methods on CIDDS-001 is carefully studied and experimentally evaluated through Deep Neural Networks (DNN), Random Forest, Voting, Variational Auto-Encoder (VAE), and Stacking machine learning classifiers. The proposed system was able to detect attacks with up to 99.99% accuracy when handling the imbalanced class distribution with less number of samples, making it more convenient in real-time data fusion problems that target data classification.

Designing a machine learning based network intrusion detection system (IDS) with high-dimensional features can lead to prolonged classification processes. This is while low-dimensional features can reduce these processes. Moreover, classification of network traffic with imbalanced class distributions has posed a significant drawback on the performance attainable by most well-known classifiers. With the presence of imbalanced data, the known metrics may fail to provide adequate information about the performance of the classifier. This study first uses Principal Component Analysis (PCA) as a feature dimensionality reduction approach. The resulting low-dimensional features are then used to build various classifiers such as Random Forest (RF), Bayesian Network, Linear Discriminant Analysis (LDA) and Quadratic Discriminant Analysis (QDA) for designing an IDS. The experimental findings with low-dimensional features in binary and multi-class classification show better performance in terms of Detection Rate (DR), F-Measure, False Alarm Rate (FAR), and Accuracy. Furthermore, in this paper, we apply a Multi-Class Combined performance metric Combi ned Mc with respect to class distribution through incorporating FAR, DR, Accuracy, and class distribution parameters. In addition, we developed a uniform distribution based balancing approach to handle the imbalanced distribution of the minority class instances in the CICIDS2017 network intrusion dataset. We were able to reduce the CICIDS2017 dataset's feature dimensions from 81 to 10 using PCA, while maintaining a high accuracy of 99.6% in multi-class and binary classification.

Machine learning algorithms are effective means applied to wireless intrusion detection systems (WIDS) in an attempt to protect computing resources against unauthorized access. A key aspect for an improved WIDS based on machine learning classification is features selection. This paper considers multiclass classification that utilizes four effective features sets of 32, 10, 7 and 5 features, respectively. The classes represent 15 types of 802.11 MAC layer attacks, and the features represent 802.11 frame fields information. The experimental results utilized the Aegean Wi-Fi Intrusion Dataset (AWID) to evaluate the performance of seven well-known machine learning classifiers, namely, AdaBoost, Random Forest, Random Tree, J48, logit Boost, Multi-Layer Perceptron, and ZeroR with respect to the selected features set. The presented work outperforms previous related work in terms of number of classes, features and accuracy. The proposed system using the Random Forest algorithm and 32 features achieves a maximum accuracy of 99.64%. By using logit Boost with five features, we achieved a maximum accuracy of 99.53%.

The increasing amount of network throughput and security threat makes intrusion detection a major research problem. In the literature, intrusion detection has been approached by either a hardware or software technique. This paper reviews and compares hardware based techniques that are commonly used in intrusion detection systems with a special emphasis on modern hardware platforms such as FPGA, GPU, many-core processors and ASIC. It also provides a detailed comparison between these hardware solution platforms. Our approach to classify modern hardware-based Intrusion Detection System (IDS) techniques is based on the detection approach. In addition, we provide a comparison between the classified detection approaches based on essential criteria such as definition, update process, detection ability, features of the system, and implementation requirements. Finally, a classification tree of hardware-based NIDS platforms is given.

In cybersecurity, machine learning approaches can predict and detect threats before they result in major security incidents. The design and performance of an effective machine learning based Intrusion Detection System (IDS) depends upon the selected attributes and the classifier model. This paper considers multi-class classification for the Aegean Wi-Fi Intrusion Dataset (AWID) where classes represent 17 types of the IEEE 802.11 MAC Layer attacks. The proposed work extracts four attribute sets of 32, 10, 7 and 5 attributes, respectfully. The classifiers achieved high accuracy with minimum false positive rates, and the presented work outperforms previous related work in terms of number of classes, attributes and accuracy. The proposed work achieved maximum accuracy of 99.64% for Random Forest with supply test and 99.99% using the 10-fold cross validation approach for Random Forest and J48.