A Fusion-Based Data Mining Model for Intrusion Detection in Distributed Environments

Abstract

As distributed systems become more prevalent, the frequency of distributed attacks—such as distributed denial-of-service (DDoS) and worms—is increasing. Traditional intrusion detection systems are struggling to efficiently identify and report threats in a timely manner. Consequently, various Distributed Intrusion Detection Systems (DIDS) utilizing machine learning algorithms have been implemented. However, their effectiveness has been limited due to high computational costs and suboptimal accuracy levels. This paper aims to enhance the Fusion-Based Data Mining Model for Intrusion Detection in Distributed Environments. Two well-known distributed attack datasets, NSL-KDD’15 and UNSW-NB’15, were utilized in this study. (Fusion-Based Data Mining Model (FBDMM)) was chosen as the evaluation framework due to its widespread use. To minimize computational costs, both Principal Component Analysis (PCA) and Information Gain Ratio (IGR) were employed to extract the five most significant features from each dataset. Classifiers such as Support Vector Machines (SVM), Naïve Bayes (NB), and Multilayer Perceptron (MLP) were The hybridized using a Voting Classification technique to boost accuracy. The The hybridized Data Mining Model (Fusion-Based Data Mining Model (FBDMM)) comprised six classifiers: PCA+SVM, IGR+SVM, PCA+NB, IGR+NB, PCA+MLP, and IGR+MLP. The evaluation results were compared across these six classifiers based on accuracy (ACC), detection rate (DR), and false alarm rate (FAR). Computational costs, measured in System Running Time (SRT), were compared between five-feature and full-feature sets: forty-one features for NSL-KDD’15 and forty-nine features for UNSW-NB’15. The Fusion-Based Data Mining Model (FBDMM) achieved ACC, DR, and FAR values of 77.78, 96.98, and 2.55, respectively, while the highest performance among individual classifiers for NSL-KDD’15 was 72.17, 92.29, and 2.71. For UNSW-NB’15, the Fusion-Based Data Mining Model (FBDMM) recorded ACC, DR, and FAR values of 85.58, 95.98, and 3.35, respectively, with the best performance from individual classifiers being 82.88, 97.23, and 4.66. The SRT for NSL-KDD’15 was 10 seconds with five features and 5,200 seconds with forty-one features, while for UNSW-NB’15, it was 9 seconds with five features and 68,000 seconds with forty-nine features. The findings indicate that fusion-based Data Mining Model outperforms existing data mining models used in Distributed Intrusion Detection Systems in terms of both accuracy and computational cost. Therefore, fusion-based Data Mining Model is recommended for use in Distributed Intrusion Detection.