Comparative analysis of classification techniques for network anomalies management

Today, the rapid development in technology is enabling billions of devices to communicate with each other. This development requires new network technologies to allow all these devices to connect to network easily. In recent years, cyber-attacks have been a serious threat to governments, businesses and individuals. Many Intrusion Detection Systems, which were designed to prevent these cyber-attacks failed. Intrusion Detections Systems (IDS) could not sufficiently recognize the attacks and the cunning ways the attackers used, resulting in inefficient IDS solution and vulnerable networks. It would be a much smarter solution to counteract attacks by using machine learning based systems that is the result of data mining and statistics. This approach will provide a more efficient IDS solution than a conventional IDS solution based on attack recognition techniques. The purpose of this thesis is to propose a method for Network Anomaly Detection System (NADS) using machine learning algorithms with the aim of enhancing the processes of the network troubleshooting, and raising the efficiency of the maintenance processes. This study compares the performance of four selected machine learning classifiers with each other. The selected algorithms are: K-Nearest Neighbors (KNN), K-means, Naïve Bayes and Random Forest. This comparison is conducted to detect the network anomaly and analyze the performance of the classification framework. This comparison is conducted to provide recommendations related to the framework selection. The above mentioned algorithms are implemented and tested on KDD CUP99 intrusion detection dataset that is widely used to evaluate intrusion detection prototypes. The experimental outcomes demonstrate that KNN algorithm perform well in terms of accuracy and computation time. Furthermore the results show that KNN has a successful detection of potential threat of 98.0379 % of all known attacks.