Optimization of predictive performance of intrusion detection system using hybrid ensemble model for secure systems

Network intrusion is one of the main threats to organizational networks and systems. Its timely detection is a profound challenge for the security of networks and systems. The situation is even more challenging for small and medium enterprises (SMEs) of developing countries where limited resources and investment in deploying foreign security controls and development of indigenous security solutions are big hurdles. A robust, yet cost-effective network intrusion detection system is required to secure traditional and Internet of Things (IoT) networks to confront such escalating security challenges in SMEs. In the present research, a novel hybrid ensemble model using random forest-recursive feature elimination (RF-RFE) method is proposed to increase the predictive performance of intrusion detection system (IDS). Compared to the deep learning paradigm, the proposed machine learning ensemble method could yield the state-of-the-art results with lower computational cost and less training time. The evaluation of the proposed ensemble machine leaning model shows 99%, 98.53% and 99.9% overall accuracy for NSL-KDD, UNSW-NB15 and CSE-CIC-IDS2018 datasets, respectively. The results show that the proposed ensemble method successfully optimizes the performance of intrusion detection systems. The outcome of the research is significant and contributes to the performance efficiency of intrusion detection systems and developing secure systems and applications.


INTRODUCTION
The increase in the active internet users has set off significant risks to the network resources and communication security (Abdulhammed et al., 2018).Any unauthorized activity by an illicit individual, triggering changes to the network resources and systems, stealing sensitive/valuable network resources, or malicious actions to disrupt normal routine of the network is considered as intrusion (Saeed, 2022).A network intrusion detection system has the ability to prevent, detect and respond to such attacks (Belouch, Deep learning technology has widely been used in the development of the NIDS for realtime systems (Abdel-Basset et al., 2021;Hussien, 2020).Its effective feature extraction ability from the raw data has made this a popular practice for the development of automated systems.Recent research has shown that although it works better for network anomaly detection and outperforms the traditional machine learning and rule-based methods, it still has some drawbacks.First, it requires huge, labeled datasets which are mostly not available publicly.Secondly, this technology is computationally expensive and requires costly graphic processing units (GPUs) and other computing resources (Abdel-Basset et al., 2021).Additionally, the deep learning-based system is vastly complex and hard to interpret.In recent years, Internet of Things (IoT) and edge computing has been the focus for the communication between various computing and networking devices (de Souza, Westphall & Machado, 2022).Many traditional computing systems don't have high-end computing resources, therefore, the deep learning methods might also not be fully utilized in the IoT and edge computing domain due to resources limitations (Nasir et al., 2022).Moreover, small and medium enterprises (SMEs) generally lack the required resources, and skills to combat cyber-attack vectors, yet they need to utilize some methods to stay competitive and secure.Newer methods/technologies, to be adopted by developing SMEs, are valuable only if they are cost-effective and robust in resisting latest unknown network attacks.
Network intrusion detection is very crucial for organizations to safeguard against data theft.Traditional intrusion detection methods work on rule-based systems where manual analysis of network traffic is quite a challenging problem.Although machine learning based methods can help in learning the traffic behavior from historical data, however, working with real time traffic data requires manual feature selection which requires time and domain expertise.Traffic data is usually high dimensional and determining important features is an important step for predictive systems.In addition, simple machine learning algorithms can struggle while working with high dimensional data.Ensemble learning is a technique in which multiple algorithms are used for prediction.Ensemble learning helps in increasing the predictive performance for a given problem.Therefore, an ensemble method which could be integrated with important features selection techniques, is required for developing high performance predictive methods for network intrusion detection.
In this article, a hybrid ensemble method is proposed for the development of an efficient cost-effective network intrusion detection system.Based on the evaluation of the performance of major machine learning and deep learning algorithms on four performance parameters, including accuracy, precision, recall, and F1-score, a costeffective model is proposed to optimize the predictive performance.One of the major challenges in evaluating performance of machine learning models is the unavailability of large datasets.In previous research works, KDD CUP 99 dataset (University of California at Irvine, 2022) has been prominently used which is outdated and does not depict real attacks in the networks.The present research work uses Network Security Laboratory-Knowledge Discovery and Datamining (NSL-KDD) (Canadian Institute of Cybersecurity, 2022), University of New South Wales-New Brunswick (UNSW-NB15) and Communications Security Establishment-Canadian Institute of Cybersecurity (CSE-CIC-IDS2018) datasets.Data preprocessing steps were applied on the dataset to make it compatible with the algorithm requirements.Additionally, a feature selection method has been implemented to select the best input features for the selected classification algorithms.Conclusively, the ensemble model optimized the prediction of domain specific attacks and contributed to the design of secure networks systems, and applications.

LITERATURE REVIEW AND RELATED WORK
During recent years, artificial intelligence techniques, due to their powerful automated feature extraction methods, have been widely implemented to develop solutions in the broader domain of security.During the last decade, many researchers have used machine learning and artificial intelligence algorithms for detection of network intrusion.Various learning-based methods have been proposed to improve the performance of intrusion detection systems.In this section a thorough review of related work is presented where latest algorithms and techniques have been studied to identify the prospects of improvement in terms of efficiency, accuracy, and cost-effectiveness of intelligent network intrusion detection methods.Abdulhammed et al. (2018) proposed a machine learning method for wireless network intrusion detection system that included classification and feature selection methods.They first preprocessed the data to feed the model and later applied various algorithms such as AdaBoost (adaptive boosting), random forest (RF), and multilayer perceptron (MLP), where the focus was to improve the feature reduction in input data for classification algorithms.This helped in increased speed and detection accuracy.Four feature sets were selected and applied to the models for training.The results showed that RF performed better using 32 input features.The final model developed in this research work resulted in 99% accuracy, 0.99 precision and 0.966 recall on test dataset.The developed system was later applied on an AWID dataset for real-time intrusion detection.Researchers also compared the performance of machine learning methods to show that the proposed and developed model was performing well on the test dataset.Belouch, Hadaj & Idhammad (2018) conducted a research study to evaluate the performance of four classification methods for intrusion detection in networks.They evaluated support vector machine (SVM), Naive Bayes (NB), RF, and decision tree algorithms for the desired output.Apache Spark tool was used to classify the intrusion traffic, whereas, publicly available dataset, UNSW-NB15, with 42 input features for training the machine learning models was used.The experiments showed that RF outperformed the other models and achieved an accuracy of 97% on test data with 93% sensitivity and a specificity of 97%.Further, in the same year, Bhosale, Nenova & Iliev (2018) presented a new filter-based feature selection algorithm which was based on hybrid approach for feature selection.A subset of features was optimized by the hybridized feature selection approach (HFSA) for building a classification algorithm for multi-class classification task.The model was trained using real-time packets which were captured using the JPCAP package.Researchers used a Naive Bayes algorithm for classification of normal attacks.Before feeding the data to the model, it was preprocessed with two methods.First, the data was converted to numerical values and then applied to a phase of data normalization where features were scaled between 0 and 1.Then feature selection was applied along with the Naive Bayes classifier to classify six types of attacks that were normal, remote to user (R2L), denial of service (DoS), user to root (U2R), brute force attacks, and probe.The proposed HFSA algorithm was applied for classification enhancement.The final model achieved an accuracy of 92% while 95% precision and 90% recall values were recorded.
Later, Kim et al. (2020) developed a distributed denial of service (DDoS) detection and classification system using convolutional neural network (CNNs) and compared the performance with recurrent neural networks (RNNs).The system was evaluated using KDDCup99 and CSE-CIC-IDS2018 to differentiate the malicious DDoS traffic from normal network traffic.On KDDCup99, an average accuracy of 99.9% was achieved while CSE-CIC-IDS2018 yielded 91.997% average accuracy for binary and multi-class classification of DDoS traffic.The RNN accuracy was 99% for binary classification but for multi-class classification RNN could only achieve 93% accuracy, on KDDCup99.CNN also outperformed the RNN on CSE-CIC-IDS2018 dataset with 91.3% accuracy as compared to 65% accuracy, respectively.Here, researchers only discussed DDoS categorization while neglecting other classes of datasets.Moreover, convolution operation is very costly, and it increases complexity of the overall system.Injadat et al. (2020) introduced a multi-stage optimized NID framework using optimized ML algorithms with lesser complexity and increased detection performance.Additionally, they studied the impact of oversampling, training size, and information gain and correlation-based feature selection techniques.The framework consisted of a combination of random search, particle swarm optimization (PSO), genetic algorithm (GA) for feature selection and KNN and RF classifiers.The performance was evaluated on CICIDS2017 and UNSW-NB-15 datasets with more than 99% accuracy on both datasets.The framework required only 74% of training sample size and 50% features for training.The proposed work was a multi-stage framework where each module was dependent on the previous one, which highlighted the need for an end-to-end system with fewer dependencies.Pokharel, Pokhrel & Sigdel (2020) presented an IDS which was based on hybrid machine learning classification algorithm.Profile improvement methods were applied to improve the detection of abnormal user behavior.The hybrid method was based on Naive Bayes classifier and SVM for abnormal behavior detection.Data preprocessing was also applied on the raw input data.These feature normalization, feature scaling and feature selection methods improved the performance of IDS by achieving an accuracy of 93.1% and a precision of 95.8%.Chkirbene et al. (2020) proposed a dynamic intrusion detection and classification method using feature selection technique.They develop two methods for intrusion detection namely trust-based intrusion detection and classification system (TIDCS) and trust-based intrusion detection and classification system-accelerated (TIDCS-A).They utilized feature selection algorithm to reduce the input features.High rank features are selected to train the system for optimal performance.Both algorithms were trained using NSL-KDD and UNSW datasets and experiments showed that they could detect attacks with greater accuracy and less false alarm rate.The final model achieved an accuracy of 91% using the TICDS method.Xu et al. (2020) presented a new intrusion detection system log-cosh conditional variational autoencoder (LCVAE).It utilized properties of CVAE, and a new loss function log-cosh was introduced which balanced the generation and reconstruction of intrusion data for data classes with fewer samples.For classification and feature extraction, CNN was used, which achieved an accuracy of 85.51% on NSL-KDD dataset.The research considered binary classification while using expensive DL methods.
Gu & Lu (2021) used SVM with Naive Bayes feature embeddings to develop an intrusion detection system.Naive Bayes algorithm was utilized to transform features for data state conversion.SVM model was trained as a classifier.The method was applied to many datasets including UNSW-NB15, NSL-KDD, Kyoto 2006+ and CICIDS2017.Various features were selected from these datasets for training the classifier.The final system was compared with a simple SVM model.This comparison showed that performance of SVM increases by using Naive Bayes embeddings.The best results were obtained using NSL-KDD dataset and the highest accuracy of 99.36% was achieved with a detection rate of 99.25%.Gu & Lu (2021) proposed to enhance the quality of the data for intrusion detection problems.They argued that quality of data can help in the development of robust intrusion detection systems.In their research, they utilized Naive Bayes feature transformation technique to enhance the data quality.Later, they trained SVM classifier on the transformed dataset.The accuracies were 93.75%, 98.92%, 99.35% and 98.58% on UNSW-NB15, CICIDS2017, NSL-KDD and Kyoto 2006+ datasets respectively.However, researchers only considered binary classification where the system could only differentiate between normal and attack traffic with no information about the class of the attack.In addition, they extracted random data to balance the dataset instead of utilizing the complete dataset.Zhao et al. (2021) developed an efficient network intrusion detection using combination of convolutional network and dynamic autoencoders.They also presented a new loss function for NID to train autoencoder and classifier together.The lightweight structural design helped to extract the efficient feature extraction which achieved high accuracy of 93.1% and 98.5% on KDD99 and UNSW-NB15 respectively.Yet gain, researchers only consider binary classification problem and focused on development of lightweight NID method.
Abdel-Basset et al. ( 2021) proposed a semi-supervised deep learning based intrusion detection system in IoT networks.Researchers introduced a multiscale residual temporal convolutional module (MS-Res) to help network learn the spatiotemporal representations.To improve the importance of influential features, a traffic attention (TA) mechanism was developed.The system was evaluated using CICIDS2017 and CICIDS2018 datasets with more than 99% accuracy in case of binary class classification scenario.Researchers supported the claim that deep learning requires more data and computational cost.Xu et al. (2021) proposed a new five-layer autoencoder model for network anomaly detection.The data bias, due to redundant samples, was removed by preprocessing the data and outliers were removed to reduce the effect of detection bias.It was trained on NSL-KDD and achieved an accuracy of 90.61% and 92.26%.Consideringly, autoencoder is computationally expensive deep learning model and the system could only differentiate binary classification problems.
Recently, in 2022, a research study presented a network behavior anomaly detection method based on deep belief network.The method worked by extracting features using deep belief network (DBN) and dimensions were reduced.A DBN was pre-trained on small training data using unsupervised learning and then it was again trained using supervised learning to extract useful features.Later, a light long short-term memory (LSTM) network was used to classify the network anomalies.The proposed model was evaluated using KDD99 with 94% accuracy and CICIDS2017 with 86.8% accuracy.The performance of the proposed model was not good in classes with fewer records.Moreover, in another limitation, two models were needed to train.Therefore, an end-to-end model is required to reduce false alarm rates and enhanced performance (Chen, Fu & Zheng, 2022).Roy et al. (2022) introduced a cyber-attacks detection model for IoT networks.They preprocessed the data using removal of redundant features, sampling the dataset, and reducing dimensions of the dataset.These steps helped in choosing the most relevant features for intrusion detection.In addition, they used the B-Stacking method which is a combination of boosting and stacking algorithms.Researchers utilized CICIDS2017 and NSL-KDD dataset for evaluation.The proposed system has a high detection rate and low false alarm rate with 98.5% and 99.11% accuracy on NSL-KDD and CICIDS2017 datasets respectively.However, research presented lower results on U2R and R2L and the proposed model was only for IoT networks.In a similar research (de Souza, Westphall & Machado, 2022), the authors presented a two-step ensemble approach for intrusion detection in IoT and fog computing.In the first step they used an extra tree as a binary classifier to analyze the traffic and later an ensemble based on ET, RF and DNN was used to detect intrusion traffic.Researchers performed experiments with Bot-IoT, NSL-KDD, IoTID20 and CICIDS2018 datasets.This approach achieved an average precision of 100% with 100% recall value on bot-IoT dataset.On NSL-KDD dataset they achieved 99.81% accuracy with 99.81% precision.Again, low results on U2R (68.75) and R2L (96.31) were reported on NSL-KDD dataset.Fewer attacks related to IoT networks were presented, with no countermeasures.Zhang et al. (2022) introduced RANet based on group gating convolutional networks.In the last maxpooling layer, they applied an overlapping method and tested the proposed model on five publicly available datasets.It achieved an accuracy of 83.23%, 69.04%, 99.78%, 97.55%, and 96.73% on NSL-KDD Test (+), NSL-KDD (21), KDDCUP99, Kyoto and CICIDS2017 datasets respectively.However, the proposed system showed low performance on infrequent network attack types and had weak interpretability.Rashid et al. (2022) worked on the development of tree-based stacking algorithm using DT, RT and XGBoost.In addition, the effectiveness of k-best model for features selection was analyzed.Researchers evaluated the system using NSL-KDD and UNSW-NB15 datasets with 20 features based on their score.An average accuracy of 93.7% and 99% was achieved on UNSW-NB15 and NSL-KDD datasets respectively.But the authors only considered binary classification problem due to which the system could not differentiate between various attack classes.Another research work utilized CNN for feature extraction and meta-heuristic LSTM for detection of DDoS attack.For effective feature selection and minimizing the correlation among features, they developed a closest position grey wolf optimization (CP-GWO) algorithm with less complexity and better convergence.To evaluate the performance of model DARPA1998, DARPA LLS DDoS-1.0,CICIDS2017, NSL-KDD and KDD99 datasets were used with 96.52%, 95.94%, 96.52%, 96.37% and 96.37% respectively.The research work focused on binary classification of DDoS vs benign network traffic where performance on NSL-KDD is comparatively lower (Dora & Lakshmi, 2022).Nasir et al. (2022) presented an intelligent framework (DF-IDS) to secure edge IoT using deep learning.The framework presented two stages, where first stage started by selecting features using spider monkey (SM), PCA, information gain (IG) and correlation attribute evaluation (CAE).The selected features were fed to a deep neural network.The framework was tested using NSL-KDD dataset and achieved an accuracy of 99.23% and F1-Score of 99.27%.Again, this research worked on binary classification where the system could only differentiate between normal and attack traffic with no information about the type of attack.Otair et al. (2022) presented a wireless sensor networks intrusion detection system using grey wolf optimizer (GWO) and particle swarm optimization (PSO).Researchers selected important features using GWO and utilized PSO to attain global optimum values for selected features.To classify the network traffic an ensemble algorithm consisting of KNN and SVM was used.NSL-KDD was utilized to evaluate the performance of the proposed system with 98.97% accuracy.This also works on binary classification only.Another research Saeed (2022) proposed a hybrid system for real-time intrusion detection of streaming data.Researchers selected 16 features from input data that contributed to the performance enhancement.For classification, KNN, Naive Bayes and a hybrid classifier were used on NSL-KDD and KDD99 datasets with more than 99% accuracy.This system also considers binary classification problem while neglecting information about the type of attack.
Table 1 summarizes the work reviewed in this study including authors, dataset information, pre-processing techniques, feature selection methos, classification techniques, number of features used, evaluation metrics and limitations.
The table presents the summarized relevant information.Some of the problems with the recent work are discussed based on classification type, dataset choice, required computational resources, training complexity and low results on minority classes.
In the literature, majority of the researchers have worked on binary classification of intrusion traffic (Gu & Lu, 2021;Zhao et al., 2021;Rashid et al., 2022;Dora & Lakshmi, 2022) while some also worked on multi-class classification using deep learning techniques (Chen, Fu & Zheng, 2022;Zhang et al., 2022;Abdel-Basset et al., 2021;Moizuddin & Jose, 2022).However, deep learning requires computational resources and time to train the models (Gu & Lu, 2021).This claim is also supported by results of the deep learning algorithm experiments performed in this research.In addition to that, large, labeled datasets are also a primary requirement to train deep learning algorithms.Although some of the researchers have used simple ML based approaches but they utilized older dataset such as KDD99 (Saeed, 2022;Zhang et al., 2022;Dora & Lakshmi, 2022).Moreover, in some recent studies (Chen, Fu & Zheng, 2022;de Souza, Westphall & Machado, 2022;Roy et al., 2022), detailed analysis and classification of network intrusion is done using machine learning, still, they achieved low results on minority classes.Besides, various researchers (Injadat et al., 2020;Gupta, Jindal & Bedi, 2022) developed complex module-based approaches that cannot be directly used on low-end devices.
To fill the gap in literature, an end-to-end lightweight and cost-effective machine learning approach for optimized network intrusion detection is developed, by utilizing latest intrusion datasets to evaluate the approach.As compared to the recent studies, the proposed method is simple, computationally efficient, works on multi-class classification and does not require high-end computational resources.The popular deep learning algorithms such as CNN, RNN and LSTM were also trained to compare the performance of the proposed system with the deep learning-based methods.The proposed method gives results that are comparable to the latest deep learning approaches and has some considerable advantages over deep learning-based approaches.

METHODOLOGY AND EVALUATIONS
In the proposed method, data normalization technique, and a wrapper-based feature elimination method are utilized to select 13 and 15 important features from NSL-KDD and other two datasets, respectively.Only 31%, 33% and 21% features for NSL-KDD, UNSW-NB15 and CSE-CIC-IDS2018 datasets were used, respectively.In the next step, a hybrid stacking ensemble was developed using RF-RFE, MLP, Random Forest and SVM for classification.A majority voting mechanism was utilized to calculate the probabilities of attack classes.The results indicated the superiority of the proposed approach for network intrusion detection.
For this study, datasets were downloaded from public repositories.The input data was normalized, and features were reduced using a hybrid method i.e., RF-RFE.In the next step, the datasets were again saved in the reduced form, and were split into training and testing parts.Initially, major machine learning algorithms were utilized to learn the attacks behavior and classes.However, due to complex nature and high-dimensional data, single algorithms didn't work quite well.To overcome this issue, the proposed hybrid ensemble algorithm was trained on preprocessed datasets to learn the attack types.To evaluate the system, widely used classification metrics were utilized, as shown in Fig. 1.

Dataset description
The characteristics and features of datasets used in the evaluation of the proposed mode have been presented as follows.

NSL-KDD
In related work, most of the researchers used KDDCup99 for training their final systems.Although this dataset is good to train the classifiers, but it has some issues such as duplicate values and lack of real-world attacks scenarios.To develop a practically applicable robust intrusion detection system, this research work primarily used a newer dataset, NSL-KDD, to validate the performance of the proposed method, as it had real-world scenarios and millions of network records for NID evaluation.This dataset does not have redundant records, so any model trained on this dataset should not be biased towards repeated attack records.The NSL-KDD (Canadian Institute of Cybersecurity, 2022) consists of four subdatasets that are KDD Test+, KDD Train, KDD Test-21, and _20 Percent.The dataset has records of various network attacks that an intrusion detection system must detect to avoid security problems.There are total of 43 features in this dataset for a single record.Out of 43 features, 41 are related to traffic input and the other two are labels and scores of traffic input.This dataset has a total of four classes for various attacks: probe, user to root (U2R), denial of services (DoS), and remote to local (R2L).A breakdown of number of records distributions is presented in the Table 2.
As mentioned, a DoS attack tries to shut down the system while the other three attacks are related to gaining access to system and sensitive information.This dataset suffers class imbalance problem where more than half of the records are normal.Distribution of U2R and R2L attacks is very low as compared to DoS attack.This property of the dataset resembles the real-life scenarios where DoS is the main type of attack that is a threat to the network and a smaller number of U2R and R2L attacks are seen in real environments.The input features in the dataset can be divided into four main categories that are: intrinsic, content, time-based, and host based.

UNSW-NB15
This dataset was created by the Australian Center for Cyber Security (Moustafa & Slay, 2015) having more than two million records, 48 features and nine different attack types.These features were extracted using newly developed algorithms such as Bro-IDS and Argus tools.The dataset was generated in the Cyber Range Lab where realistic state-of-theart normal, and synthetic abnormal networks were established.The features are further categorized into five major groups which are flow features, basic features, content features, and time features along with additional generated features.The dataset contains nine types of different attacks: Fuzzers, Analysis, Backdoors, DoS, Exploits, Generic, Reconnaissance, Shellcode and Worm.Table 3 presents the overall statistics of the UNSW-NB15 dataset.

Preprocessing
As discussed above, raw dataset might not yield good results due to class imbalance, various data types and huge number of input features.Therefore, to develop robust machine learning models, input features were preprocessed to overcome the challenges.In the following section, an approach for dataset preprocessing is discussed in detail.The preprocessed datasets were later used in training machine learning algorithms.

Feature normalization
To develop a robust machine learning classifier, data normalization is required.It is the process of standardization of input data features to remove the biasness of the machine learning classifier.The data values are standardized by the maximum value in that data feature so that they lie in between standard values of (0-1).The normalization operation was applied by using Eq. ( 1).As a result of this process, all the numerical values were converted to a value range of 0 to 1.
In this equation, x is the original feature value, where X′ is the normalized value.r and l are standard deviation and mean respectively.Due to the normalization process, some features with high numerical values cannot affect the performance negatively.In addition, only 13 out of 41 features were used for final classification, in the case of NSL-KDD dataset.The detail of feature selection is provided in the next section.

Feature selection
There are total of 41 input features in the NSL-KDD dataset, while there are 45 and 73 input features in the UNSW-NB15 and CSE-CIC-IDS2018 datasets, respectively.Selected target labels might not be affected by some input features.Keeping this in view, only those features were retained which were required for classification purposes.For this task, RFE was utilized for feature selection (Guyon et al., 2002), which is a wrapper based backward feature selection method.In this technique a model is built using an entire set of input features.Then, the important score for each feature is calculated.In this recursive process, the least important features were removed by retraining models on various sets of features.
Here, a subset of feature size is a tuning parameter to calculate specific number of features.When a subset gives optimal performance, that subset is used for predictors.The final optimal subset is used to train the final algorithm.In simple words, RFE performs a greedy optimization search to find the best performing feature subset for final model.Algorithm 1 describes the feature selection based on RF-RFE method.
All models cannot be paired with RFE method, because when number of features increase as compared to the number of samples, some models cannot be used with RFE.RFE with RF is used in this study for two reasons.First, RF does not tend to exclude the variables from prediction equation.An ensemble method usually has increased performance as compared to the individual models.RF, being an ensemble method, enforces the trees to have sub-optimal splits of features using random sample of input features.Second reason to include RF as base learner in RFE is because it has internal mechanism to measure the importance of features (Chen et al., 2018).Other than RF-RFE feature selection method, various other methods are widely utilized by the researchers.For example, in Gulla et al. (2020) researchers applied a combination of Gray Wolf Optimization (GWO) and Particle Swarm Optimization (PSO), however the results from this study are superior as compared to the Gulla et al. ( 2020) and a study in Roy et al. (2022) where k-best method was utilized.This research experimented with several methods for feature selection, however in this study only results of best performing method i.e., RF-RFE are discussed.
In addition, t-stochastic neighbor embedding (t-SNE) visualization was also used to visualize 41 features as shown in Figs. 2 and 3. T-distributed stochastic neighbor embedding (t-SNE) is a statistical data visualization method for high dimensional data.The method visualized the data points by giving each datapoint a location in a threedimensional space.The method is based on stochastic neighbor embeddings.It is a nonlinear technique for data dimensionality reduction.It can be seen from the visualizations that the red dots overlap the blue and other dots representing different kinds of attacks in different regions.It becomes difficult for the learning algorithm to learn various distribution areas for the same type of attack traffic at the same time.The RF-RFE algorithm, applied to data, suggested only 13 features that were important for classification.In Fig. 4, t-SNE visualization for features selected by RF-RFE algorithm for final classification is shown.Features selected by RF-RFE help to differentiate the attack types and decreases the overlap between attacks.

Machine learning algorithms
Most ML algorithms need extracted features while deep learning, which is a subset of machine learning, does not require extracted features as it directly learns from the data.Instead of direct implementation of popular algorithms, in some cases, algorithms are merged to form ensemble models.In this research study, five individual ML models and

Hyperparameters values
Hyperparameter values are necessary in machine learning approaches to train the proposed model.

Ensemble method
The main idea behind the ensemble learning is to get the advantage from various classifiers by learning in a collective ensemble way.Each classifier has its own strengths and drawbacks for data classification.Some classifiers perform well on specific types of attacks while others may perform well on the rest of attack types.The key idea is to combine several weak classifiers by training multiple classification models and develop a strong classification model by utilizing a voting algorithm.In this way, weaknesses of the classification algorithms can be reduced to develop a strong classification model.The proposed ensemble model is based on RF, MLP and SVM classification models.These algorithms were trained collectively via a hybrid approach where RF-RFE helped to reduce the input features and later, a stacking ensemble method used the individual predictions to calculate the final class prediction using majority vote.The proposed method helped in minimizing the variance and increasing the predictive force of collective learners.The results showed that the performance gains were notable when utilizing the proposed ensemble method.Figure 5 presents the basic idea of the proposed approach in this article.Algorithm 2 presents the steps in the proposed ensemble model training and testing.

Evaluation metrics
Several evaluation methods have been used to evaluate the performance of classifiers.Most of the metrics come from the information retrieval domain.Some of the popular metrics to evaluate the classifier are precision, recall, accuracy, F1-score, and mean absolute error (MAE).In this section, various evaluation metrices for classifiers' evaluation are described.Many of these metrics can be calculated by using a confusion matrix.A typical confusion matrix is presented in Table 6.This confusion matrix forms the basis of various other metrics to evaluate the final classifier.The correct and incorrect predictions can be Precision-It indicates the probability of a test instance that was positive and correctly identified as positive.It is given by: Recall-It is also called true positive rate.It gives us the indication of actual positive values which were identified correctly.It can be calculated by following formula: F1-Score-It is the harmonic mean of sensitivity and precision.The final classifier can be evaluated using this evaluation metric.It can be calculated as:

RESULTS AND DISCUSSIONS
The proposed machine learning model has been developed and trained in Python programming language using Sklearn, Keras, Pandas, and NumPy libraries.Five machine learning models and three deep learning along with proposed ensemble model have been developed in this research work.These models are trained using the preprocessed NSL-KDD, UNSW-NB15 and CSE-CIC-IDS2018 datasets to select the best performing mode.
All experiments were done on Intel core i5 processor on HP 840 G2 laptop with 64-bit Windows 10 operating system, and 16 GB RAM.

Evaluation using NSL-KDD dataset
The detail of results for NSL-KDD with classification performance on original set of fortyone features is presented in Table 7. Results showed that for all features used, classifiers did not give higher percentages on the performance metrices.With all features utilized, the ensemble method showed better performance than the rest of the classifiers, yet the overall performance was not appreciable.For the next stage, classification performance based on feature selection method was investigated.In total, thirteen features were selected out of the original forty-one features in the dataset.The results showed that random forest classifier achieved an accuracy of 98.81% with 97.70% precision value.The recall and F1score were obtained as 95.66% and 96.67% respectively.The lowest accuracy was achieved in the case of K-Nearest Neighbor algorithm with 94.72% accuracy score.This could be due to the reason that it is a very simple method and could not handle complex data.The overall details of the obtained results can be seen in the Table 8.Experimental results showed that RF outperformed other algorithms in terms of accuracy and precision measures.The same trend can be seen in the literature where random forest performed better as compared to the other algorithms (Taher, Jisan & Rahman, 2019).There might be two reasons for these results.First, it works by voting mechanism where predictions from various decision trees are used to make final decision.The second reason could be the fact that by having multiple decision trees in the forest, only best features that contribute to the final prediction are selected for training the final classifier.Although MLP showed better results as a single classifier, when used in an ensemble model, considering its extensive training time, preference was given to KNN.Conclusively, ensemble of RF, SVM and MLP performed undoubtedly well with less training time and high percentages on performance metrices.Hence, efficient network intrusion detection systems can be developed by utilizing high performance machine learning algorithms.Confusion matrix for the NSL-KDD dataset is given in the Fig. 6 below.
Overall performance of machine learning algorithms has been shown through a bar graph in the Fig. 7, while performance of various machine learning methods on NSL-KDD dataset is shown in Table 8 shows result of each classifier with performance metrics mapped on the attacks included in NSL-KDD dataset.For each attack type, ensemble model outperformed individual algorithms.However, a slight variation was observed in recall and F1-score metrics for U2R and Probe attack.The trees in RF protect each other from their individual prediction errors.Although some trees could be wrong but many others will be correct at the same time.Therefore, the trees as a group can make the right prediction by helping each other in the prediction task.On other hand, the ensemble method is based on heterogeneous based classifiers which do not show similar behavior and the number of attacks in Probe and U2R are very limited.Due to this, RF performed better as compared to the method on U2R and Probe.Still, the proposed method was found much better as compared to the presented methods in the related literature.
Table 9 shows result of each classifier with performance metrices mapped on the attacks included in NSL-KDD dataset.For each attack type, ensemble model outperformed individual algorithms.However, a slight variation was observed in recall and F1-score metrics for U2R and Probe attack.The trees in RF protect each other from their individual prediction errors.Although some trees could be wrong, but many others will be correct at the same time.Therefore, the trees as a group can make the right prediction by helping   each other in the prediction task.On other hand, the ensemble method is based on heterogeneous based classifiers which do not show similar behavior and the number of attacks in Probe and U2R are very limited.Due to this, RF performed better as compared to the proposed method on U2R and Probe.Still, the method was much better as compared to the presented methods in the related literature.Figures 8 and 9 represent the ROC curve for the proposed ensemble model on the NSL-KDD dataset.It shows that the TPR rate is closer to 1, which is high, while the FPR is low as desired.
Table 9, Figs.8 and 9 conclude that an IDS, using the proposed model, can effectively detect network intrusions.
Table 10 presents performance of the proposed system with some recent research works that utilized deep learning-based models for building intrusion detection systems using the NSL-KDD dataset.For a fair comparison, experiments with deep learning algorithms were carried out to demonstrate the superiority of the approach.It can be seen that the proposed approach consistently outperformed the deep learning algorithms in terms of performance

Evaluation using the UNSW-NB15 dataset
To further evaluate the performance of the proposed approach, the preprocessed dataset was used.Tables 11 and 12 presents the experimental results of the proposed approach on this dataset.
As can be seen from Table 9, using all the features for classification, results in performance degradation.This is intuitive as some features are not always important for the classification.On the other hand, the results of this study suggested that ensemble performs well and shows the superior results, as seen in Table 9.The results show that RF performs better when comparing the individual algorithms with 87.9% accuracy.The lowest accuracy score was obtained in the case of KNN that was also the least performing algorithm in case of NSL-KDD.This reason for poor performance is discussed in the previous section.Reason for RF better performance is also already discussed in the previous section.Therefore, RF was chosen in the hybrid stacking ensemble method Table 12 shows the superiority of the proposed approach as compared to individual machine learning algorithms when using the proposed RF-RFE and the stacking-based ensemble method.The proposed method yields more than 98% accuracy which outperforms RF and other algorithms.Figure 10 shows the confusion matrix obtained for the whole dataset.
Overall performance of the algorithms and the ensemble approach is shown in the Fig. 11.The figure explains that the proposed ensemble method is outperforming all the individual algorithms in terms of classification metrics.
Figure 12 represent the ROC curve for the proposed ensemble model on UNSW-NB15 dataset.It shows that the TPR rate is closer to 1 which is high for majority classes, while the  FPR is low as desired.Therefore, from the results presented in Table 12 and ROC figure, it may be concluded that an IDS, using the proposed approach, can effectively detect network intrusions.Figure 12 also show that ROC area under curve is nearly 1 for most classes which shows that the proposed method can effectively differentiate between these classes.However, in the case of class 1 (Backdoor) and class 8 (Worms) a sharp decline can be seen in the area under curve.This could be due to two reasons.Firstly, the dataset is highly imbalanced, and it has few samples as compared to other majority classes.Secondly, the dimensions in the overall dataset have been reduced using RF-RFE.This might have caused loss of important features that can increase performance for these minority classes.However, overall, the proposed method performs well as compared to the individual algorithms.Table 13 compares performance of the proposed system with some recent research works that utilized the UNSW-NB15 dataset for intrusion detection.The researchers additionally compared the results with the three deep learning algorithms as well.
Researchers have used deep learning, and machine learning-based models for building intrusion detection systems.This proposed method clearly outperforms previous works by considerable margins.Other than the model size of the RNN trained algorithm, this  approach outperformed deep learning algorithms that were trained on the same machine.
Mostly researchers only focused on binary classification therefore results in the study (Injadat et al., 2020) have better results as compared to the results of this study.However, information about attack classes is important in determining the countermeasures in case of intrusion.Therefore, superior results in binary classification might not be helpful in determining the intrusion countermeasures.In addition, mostly researchers do not provide the features that they used for classification and training and testing time requirements.As SMEs have limited resources, therefore, training and testing time might help them in selecting better choices for IDS development with limited resources and expertise.

Evaluation using CSE-CIC-IDS2018 dataset
As stated in "Dataset Description", this dataset was only considered for binary classification (benign vs malicious) as the data is imbalanced with fewer records for specific classes.Additionally, the dataset is divided into a few files where each file is a record with the name of the day the record was generated.Combining the data into one file requires huge computational power and processing such a massive dataset was not possible due to resource limitation.Therefore, only binary classification is considered.Further details of the dataset are already discussed in "Dataset Description".Table 14 provides classification performance of the algorithms using original dataset features.In the case of this dataset, RF again performs better and KNN and MLP does not perform well.In comparison to individual algorithms, the ensemble method performs better.However, performance is still low as compared to the ensemble approach using RF-RFE selected features.In the case of original features RF performance is comparable to the proposed ensemble method in terms of precision and recall.This is also confirmed from the literature (de Souza, Westphall & Machado, 2022) where RF performs well.In Table 15 the performance of algorithms using features selected by RF-RFE is compared.It can be seen in the table that the acquired results are again 1% to 2% superior.Figure 13 present the overall results of the machine learning algorithms and the ensemble method on RF-RFE features.Using RF as base learner in RFE helped in selecting useful features that help in final classification with few dimensions.
Figure 14 present the ROC curve for testing dataset.This shows a perfect area under curve of 1 in both cases.It implies that the proposed method was able to successfully differentiate between benign and malicious attacks on network.
To demonstrate the superiority of this approach, results were compared with the recent studies that utilized a similar dataset.As stated earlier, fewer researchers have investigated CSE-CIC-IDS2018 in the experiments, whereas NSL-KDD and KDD99 have been widely used.The approach was compared with a few recently published research articles and individual deep learning models.As seen in Table 16, the proposed method has performed much better than the deep learning approaches (Kim et al., 2020).Researchers have investigated newer methods for feature selection (Abdel-Basset et al., 2021) which performs better.However, it increases the computational overhead for training and testing of machine learning systems and SMEs cannot afford such expensive methods.When compared with other studies, the proposed approach is computationally friendly, and the results are also superior.One interesting thing found is the lower size of the deep learning trained models for CSE-CIC-IDS2018 when compared to the proposed model size.However, the performance of the system is slightly better than the individual algorithms with reduced training and testing time that is a requirement for real-time systems.The proposed ensemble algorithm, based on hybrid feature selection, has outperformed individual algorithms on all three publicly available datasets.In case of NSL-KDD dataset, the method yielded more than 99% accuracy and F1-score that outperformed individual best performing model i.e., RF, while only using less than half of the original dataset   features.At the same time, in comparison with the literature, the proposed method also outperformed the recent studies, as presented in Table 10.During investigation on UNSW-NB15 and CSE-CIC-IDS2018 datasets, same trends were observed where the proposed method outperformed the individual algorithms.The method yielded more than 98% F1-score and accuracy on UNSW-NB15 and more than 99% accuracy and F1-score on CSE-CIC-IDS2018 datasets.The detailed comparisons with recent studies are presented in Tables 14 and 16.The feature selection method helped in feature reduction while only selecting the best features that contributed towards the final prediction.This also helped in data dimensionality reduction and enhanced training and testing efficiency while generating state of the art intrusion detection results.

Implications
The proposed ensemble method excelled in performance metrices as compared to the individual machine learning algorithms.Moreover, in contrast to the deep learning approaches, that require large, labeled datasets, this simple ensemble method achieved the same performance without requiring high-end GPUs.This can be particularly helpful in the edge computing and internet of things (IoT) domain.As the edge devices do not have enough computation power, therefore methods based on deep learning may not work well in real-time in case of any intrusion.The first step to prevent attacks in networks is the timely detection of that attack.As discussed, in a resource constrained environment, deep learning methods might not work in real-time, so untimely detection of network intrusions can be disruptive in such scenarios.Moreover, computationally expensive deep learning models based NID systems are not a critical requirement in small and medium enterprises.SMEs can readily implement machine learning based systems and fulfil their need of combating cybercrimes.

Limitations and future work
To develop a machine learning based IDS, a comprehensive and representative of realworld attacks dataset is required.In this article, NSL-KDD is primarily used to perform extensive experiments.Although the results are superior on the dataset, a main challenge is to deploy the trained models on resource constrained devices such as edge devices and monitor the performance.In future, we would like to deploy and investigate the performance of such methods on edge devices.Additionally, the UNW-NB15 dataset has been used to evaluate the performance of the proposed method.The dataset is imbalanced, and some classes have only a few handed samples (Backdoor and Worm).These minority classes affect the performance of the overall system that can be seen in the results and experimentation section.Therefore, CSE-CIC-IDS2018 dataset was further investigated to test the proposed approach.The dataset is comparatively new and contains millions of records.One problem with this dataset is the requirement for computational resources.Still, the method works well with this dataset and performs binary classification with more than 99% accuracy.Due to unavailability of computational resources, only binary classification was investigated on a subpart of the dataset.In future we would like to extend this work to the whole dataset in multiclass classification scenario.
In future, these datasets should be extended for more efficient development of network IDS.Moreover, different sectors should develop and share real-time network intrusion datasets to help researchers design sector specific intrusion detection systems.In the current study, machine learning has shown the ability to detect attacks in network.Therefore, we believe that with the development of newer intrusion datasets, a similar approach can be extended to work with the newer datasets.

CONCLUSIONS
Defensive security has evidently become a top priority of any organizational network to safeguard against financial, reputational, and legislative exposures.Once intruded, networks and systems can be used for exploitation of vulnerabilities and transformation of a risk into an attack.This study investigates the performance of five powerful algorithms for network intrusion detection along with a newly proposed hybrid stacking algorithmbased RF-RFE feature selection method.The results showed that the proposed ensemble classifier performed equally well as compared to the other deep learning algorithms with an accuracy of more than 99.5%, 98.5% and 99.9% on the NSL-KDD, UNSW-NB15 and CSE-CIC-IDS2018 datasets, respectively.Additionally, individual selected algorithms also performed well on the benchmark datasets.The ensemble model optimizes the prediction of domain specific features and properties and contributes to designing secure networks, systems, and applications.Likewise, design solutions for secure systems and networks for varying domains can be formulated.In future, a similar approach can be extended to work with newer intrusion detection datasets.

Figure 7
Figure 7 Results of selected machine learning models for network intrusion detection on preprocessed data.Full-size  DOI: 10.7717/peerj-cs.1552/fig-7 measures, training time and testing time.One interesting observation was the lower model size of RNN trained model as compared to the proposed ML ensemble trained model in this study's experiments.

Table 1
Critical analysis of IDS methods in relevant literature.

Table 2
Attack types distribution in the NSL-KDD dataset.
dataset was created by Communication Security Establishment (CSE) and Canadian Institute of Cybersecurity (CIC) in 2018.This work was aimed to develop user-profile based diversified instructional data for intrusion detection on networks.The data resembles the actual user behavior on the network.The dataset has seven different attack classes: DoS, DDoS, web attacks, botnet, heartbleed, brute-force, and infiltration.Due to the huge amount of dataset, only a part of data was used.CSV files, only from Friday-02-03-2018 and Friday-16-02-2018, were selected for the evaluation purposes.As the data is highly imbalanced, only those parts of the data were selected that could simulate realworld attack scenarios.The selected data has four classes: normal traffic, botnet, DoS-lowHTTP and DoS-Hulk, which are merged to represent a single class i.e., attack.After removing null values and duplicate records, 1,074,342 records were retained, out of which 290,089 records were malicious.Table4provides overall details of the dataset.

Table 3
Attack distribution in the UNSW-NB15 dataset.

Table 4
Attack distribution of subset of the CSE-CIC-IDS2018 dataset.
Abbas et al. (2023), PeerJ Comput.Sci., DOI 10.7717/peerj-cs.155213/35 For deep learning models, basic and simple architectures were trained and tested to overcome overfitting as deep learning algorithms easily overfit on the training data.Architecture engineering in deep learning itself is a huge research domain.So, only training of basic variant of deep learning algorithms was considered and training the optimized deep learning algorithms for network intrusion detection was seen outside the scope of this work.Table 5 summarizes the key information about hyperparameters values used in the present research.

Table 9
Performance of various machine learning methods on NSL-KDD (Binary classification).

Table 10
Comparison of recent approaches for intrusion detection on the NSL-KDD dataset (training time on whole dataset while testing time on single data sample).

Table 12
Classification performance on the UNSW-NB15 dataset with RF-RFE features (15 features).

Table 13
Comparison of recent intrusion detection approaches on the UNSW-NB15 dataset (training time on whole dataset while testing time on single data sample).

Table 14
Classification performance based on the original CSE-CIC-IDS2018 dataset (Binary classification).

Table 15
Classification performance based on the feature selection method on CSE-CIC-IDS2018 (15 features).
Table 16 Comparison of recent intrusion detection approaches on the CSE-CIC-IDS2018 dataset (training time on whole dataset and testing time on single data sample).