TWO-PHASE NETWORK TRAFFIC INTRUSION DETECTION SYSTEM BASED ON THE RANDOM FOREST AND XGBOOST.

Abstract

The article reports a dual-stage network intrusion detection system (IDS) that implements the use of Random Forest and XGBoost in order to enhance the identification of malicious traffic in modern networks. This system then conducts binary classification in order to differentiate between normal and anomaly traffic and subsequently usage of multi-class classification is done to distinguish between particular types of attacks. Both models are evaluated comprehensively using the UNSW-NB15 dataset that has forty-five engineered features and ten traffic classes. The process of data preprocessing involves missing value imputation, feature scaling, and one-hot encoding to make sure that the input is not compromised. When using experiments, it is observed that XGBoost slightly outperforms Random Forest on the multi-class task, with an accuracy of 80.74 and both models have an accuracy of more than 93 on binary detection. The two-step process reduces the impact of the imbalance of classes and gives interpretable results through the visualization of the confusion matrix. The work provides a machine-learned pipeline that can be deployed in the real world to monitor network traffic by making use of this work to reproduce the pipeline