A Supervised Machine Learning Framework for Intrusion Detection Using NSL-KDD Dataset and Ensemble Classification Models

Abstract

We propose a supervised machine learning-based approach for intrusion detection using the NSL-KDD dataset. The primary aim is to develop and compare a reproducible offline Intrusion Detection System (IDS) that can classify normal network traffic against intrusions using experimental settings. The methodology encompasses the data cleaning, encoding of categorical features, scaling, balancing of class distribution, model building and evaluation through a common evaluation framework.

We tested five supervised learning models: Logistic Regression, Decision Tree, Random Forest, Support Vector Machine, and K-Nearest Neighbors. The models are evaluated using accuracy, precision, recall, F1-score, ROC-AUC and false positive rate. The experimental results demonstrated that the best performance was achieved with the Random Forest classifier in terms of 97.2% accuracy, 97.6% precision, 96.9% recall, 97.2% F1-score, and 0.991 ROC-AUC, with the lowest false positive rate (2.1%). This suggests that ensemble classification techniques can achieve decent performance for intrusion detection experiments, with the aid of these census-based preprocessing and stratification procedures.

The research findings show Random Forest is the best choice among the tested algorithms for the proposed IDS framework, and similar preprocessing, cross-validation and security-related metrics enhance the reliability and repeatability of machine learning-based intrusion detection studies.