Comparative analysis of machine learning algorithms in network anomaly detection

With the emergence of technologies such as Internet of Things and 5G, there has been a great boost in the number of users and the devices connected to the internet. However, parallel to this development so has increased the number of cyber-attacks. Within the context of internet traffic, the data belonging to these attacks flowing through internet are known as anomalies. A significant countermeasure against these anomalies Intrusion Detection Systems, which help avoid these attacks or at least minimize their effect. There are various methods that can be used for intrusion detection, however recently Machine Learning techniques has gained popularity and shown successful results in this area. In this study firstly a comprehensive survey of the work done in the context of network anomaly detection is performed. After careful consideration seven algorithms from seven families of supervised ML algorithms, that have been proven to obtain good results for anomaly detection, are selected. These algorithms are J48, Random Forest, K-nearest Neighbor, AdaBoost, Multilayer Perceptron, Support Vector Machines and Naïve Bayes. The performance of these algorithms are evaluated based on their accuracy, F-measure, Precision, Recall and Processing Time using two of the most up to date datasets CIC-IDS-2017 and CSE-CIC-IDS-2018. In order to evaluate the role of feature selection and classification methods, two types of classification is performed Multinomial (attack-type-wise) and Binomial (anomaly or normal). The results show that J48, RF, KNN and NB are able to achieve significant results and determine them as the strongest classifiers. MLP-NN, SVM and NB are not able to obtain good results in most cases. However we show that their performance can be improved with more careful feature extraction.