Studying the effects of hyperparameter tuning on the performance of intrusion detection systems

With the advancement of technology, technological devices, networks, and the internet have become an indispensable part of our lives. Alongside this development, ensuring the security of devices and information poses a significant challenge. This challenge not only affects individuals but also threatens institutions, organizations, companies, and governments. In this thesis, cyber-attack detection systems are extensively researched, and attack detection systems created using artificial intelligence techniques are discussed. The aim of the study is to establish a robust attack detection system against cyber-attacks and to demonstrate the impact of hyperparameter optimization, which directly affects the performance of attack detection systems, on these systems. The CICIDS-2017 and HIKARI-2021 datasets are used in the study. Machine learning methods, including the MultiTrain module, were employed for training, and feedforward neural networks, recurrent neural networks, convolutional neural networks, as well as binary and multi-classification models were constructed using the highest-rated Random Forest, Light, XGBoost, and Histogram Gradient Boosting algorithms, along with deep learning techniques. All models underwent hyperparameter optimization, and the results were evaluated comparatively. The results were assessed based on the false negative metric, which represents cases where an attack was present but labeled as non-attack. Significant improvements in the False Negative values of attack detection systems were achieved through hyperparameter optimization. The LightGBM algorithm achieved a detection accuracy of 99.97% in binary classification and 99.57% in multi-class classification. With hyperparameter optimization, a significant improvement of 94.2% was attained in the "Portscan" class for the false negative value in the LightGBM algorithm. This thesis highlights the effects of hyperparameter optimization for the intrusion detection system and demonstrates the creation of successful models.