AI-Based Intrusion Detection System

Abstract

This thesis includes the design and implementation of an AI-based IDS using supervised machine learning. The model designed has been used to categorise network traffic data into two classes: normal and malicious. The malicious traffic has been further divided into ten types of attacks. In the current study, the UNSW-NB15 dataset has been selected for experiments due to its modern taxonomy of attacks. After feature engineering and preprocessing of the data, XGBoost has been selected as the final algorithm, which uses regularisation and has been proven efficient in working with tabular datasets. The performance of the XGBoost classifier has been evaluated through metrics like accuracy, precision, recall, F1-score, and ROC-AUC. The test accuracy has been found to be 83.59%, and the macro average of ROC-AUC has been found to be 0.9640. It has been observed that although all majority classes can be categorised efficiently, minority classes like backdoor, analysis, and DoS cannot be categorised easily due to their class imbalance and similarities of their features with the exploits class. Finally, a web application has been developed using Streamlit for submitting features of network traffic data to receive results of classification instantly.