Development of a Stacked Ensemble Network Intrusion Detection System

Abstract

Securing important data and documents from unauthorized access and maintaining authorized privileges access control have been a major concern in every organization and industry; hence, a research focus for a very long time. Intrusion refers to set of activities that violate the laid down security objectives and procedures of any organization, intrusion detection system analyze network incoming traffic, in order to detect any form of security violation in it and generate an alert. This thesis focuses on the application of Stacked Ensemble Approach to Intrusion Detection Systems(IDS), Stacked ensemble exploits the strengths of various based-level models predictions and learn from them to build a more robust meta-classifier that improves classification accuracy and reduces false alarm rate. Three (3) filter-based feature selection methods comprising consistency-based, Information Gain-based and correlation-based methods were used to identify relevant features of the network traffic that identifies it as either a normal / attacks or attacks categories. Three (3) Supervised based-level machine learning algorithms comprising K Nearest Neighbor , Naïve Bayes’ and Decision Tree algorithms were used to build the base-predictive models with all the features and reduced selected features. Information Gain-based method identifies the strongest and most efficient features for the network traffic and Decision Tree models gives the highest classification accuracy on evaluation with the testing dataset, the predictions of the base-level models were used to train the three (3) meta-level learning algorithms, namely; Meta Decision Tree (MDT), Multi Response Linear Regression (MLR) and Multiple Model Trees (MMT) to build the Stacked Ensemble models. The ensemble systems were implemented with R programming language for features selection and Python programming language for the base-level and meta-level models building, it was evaluated on Core i5, 6GB RAM and 500GB HDD laptop computer. The stacked ensemble records accuracy improvement of 3.0% and 5.11% over the best and least predictions of the base-level models respectively and a reduction of 0.89% and 3.29% over base-model least and highest false alarm rate respectively . The evaluation of our work shows a great improvement over reviewed work in literature