Comparative performance analysis of ensemble learning methods in network-based intrusion detection systems

The internet usage has increased significantly in parallel with the development of technology. Such widespread use of the Internet has led to the production of large amounts of data and thus, cause more to the spread of network attacks that threaten information security elements. In order to ensure the security of these information security elements against threats, some methods are developed and used. The fact that the intrusion detection system as one of these methods has been developed using machine learning and deep learning algorithms gathers interest among the researchers. In this paper, a model of intrusion detection system is proposed by using ensemble learning algorithms in machine learning method. In this model, the performance of the designated algorithms is tested using the KDDTest + dataset on the NSL-KDD dataset. In addition, feature selection was made with the information gain method in the KDDTrain + training data set, the performances on the KDDTest+ dataset of these algorithms were also analysed. CatBoost algorithm, an ensemble learning algorithm that has newly been limited number of studies in the literature, has been chosen to be used in this model. After, the performance of the CatBoost algorithm was compared with the performances of Random Forest algorithm and AdaBoost algorithm of other ensemble learning algorithms. In this paper, the experimental environment has been generated by Python programming language, Scikit-learn, and CatBoost libraries. In the analysis of the experiment's results, the performance of CatBoost algorithm with the suggested model that used features selected by the information gain method has produced %79,43 accuracy, %68,44 precision, %96,95 recall, %80,24 f-measure and area under curve value is 0.9678 on KDDTest+ data set. In this empirical study, it was arrived that the CatBoost algorithm has better performance of intrusion detection compared to other algorithms on both executed feature selection data and unexecuted feature selection data.