A Hard Voting Ensemble Model of the Logistic Regression, Support Vector Machine and Random Forest for Network Intrusion Detection

Abstract

The rapid evolving landscape of cybersecurity, the need for robust and efficient intrusion detection systems (IDS) has never been more critical. The real-time network traffic environments are plagued with the challenges posed by traffic routing and complex network behaviours. To this end, this paper proposes four hybrid/ensemble models for the detection of intrusion across complex networks infrastructures by combining logistic regression (LR) and support vector machines (SVM), and random forest (RF). The paper leverages the hard voting ensemble strategy to mix the interpretability of LR; fusing decision capacity of RF; and classification efficacy of SVM, to enhance detection accuracy and reduce false positive rates. During the experimentation of the proposed ensemble models, the two standard datasets were acquired, that is, the KDD Cup 1999 and CSE-CIC-IDS2018, for the training and testing phases after the ENN-SMOTE method data resampling strategies. The results showed that, the resampled binaryclass dataset (KDD Cup 1999), the SVM-RF obtains best accuracy of 99.42%. The biggest precision score of 99.94% was computed for the LR-RF model. The recall measure of 99.01% was attained by the SVMLR-RF model. F1-score of 99.37% was observed for the SVM-RF model. Similarly, upon ENN-SMOTE method resampling of the multi-class dataset (CSE-CIC-IDS2018), accuracy of 92.06% achieved by the SVM-RF model. The precision of 99.68% was witnessed for the SVM-RF. With the recall score, the SVMLR-RF model offers the widest margin of 90.76%. The F1-score of 94.73% was recorded for the SVMLR-RF model. The Asymptotic Significance (2-sided test) of 0.043 is less than p-value at the significance level of 5%. The paper established that, the ensembles models performances with the ENN-SMOTE technique were more significant than the RFE for data preprocessing.