Anomaly-Based Intrusion Detection in Network Traffic using Machine Learning: A Comparative Study of Decision Trees and Random Forests

With advancements in information and virtualization technologies, the volume and growth of security threats from cyber attacks targeting networked systems are increasing. Protecting these networked systems is crucial in today's interconnected digital world. Detecting anomalies in network behavior is crucial to preventing fraud or unauthorized access and ensuring the integrity of data transmission over the internet. This highlights the crucial role of intrusion detection systems (IDS) in network security by identifying malicious attacks in network traffic. However, relying solely on data encryption, authentication, and firewalls isn't always sufficient, especially when dealing with fragmented packets that evade traditional security measures. Moreover, attackers are adept at adapting their tactics, making it increasingly challenging to stay ahead of potential threats. This study examines Anomaly-Based Intrusion Detection in Network Traffic utilizing machine learning methods such as Decision Trees and Random Forests leveraging the MachineLearningCSV data of the CICIDS-2017 dataset from ISCX Consortium to test and compare how well these two multiclass classifier algorithms work. Out of 79 features, including one feature as a label, 50 were obtained from the feature engineering step. The detection accuracy and F1 score of more than 99% were achieved using both Decision Tree and Random forest algorithms at a split ratio of 80:20. The results of two algorithms are compared, and it is observed from the ROC that the Random Forest algorithm is more effective than the Decision Tree for the multiclass classification. Additionally, the Decision Tree classifier achieved an accuracy score of 0.99867 with an execution time of 44.3 seconds, while the Random Forest classifier achieved an accuracy score of 0.99888 with an execution time of 8 minutes and 35 seconds. These results demonstrate the effectiveness of both algorithms in achieving high accuracy in intrusion detection tasks, with the Random Forest algorithm outperforming the Decision Tree algorithm in multiclass classification.