Anomaly Detection in Networks Using Machine Learning

Abstract

Abstract— The passage discusses the increasing number of attacks on the internet despite the rapid growth in its usage over the past two decades. It highlights the limitations of signature-based methods in preventing attacks, particularly zero-day attacks, which are not known or accounted for in existing security measures. To address this, the passage proposes the use of anomaly-based approaches, which have the potential to detect zero-day attacks. The study aims to detect network anomalies using machine learning methods, with a focus on the CICIDS2023 dataset due to its relevance and diverse range of attack types. Feature selection was performed using the Random Forest Regressor algorithm. Seven different machine learning algorithms were then applied in the detection process, resulting in high performance rates. The success rates achieved by each algorithm are listed as follows: Naive Bayes (NB) - 86%, Quadratic Discriminant Analysis (QDA) - 86%, Random Forest (RF) - 94%, Iterative Dichotomiser 3 (ID3) - 95%, Adaptive Boosting (AdaBoost) - 94%, Multi-Layer Perceptron (MLP) - 83%, and K Nearest Neighbors (KNN) - 97%.