Network intrusion detection systems are vital for network security, tasked with identifying and thwarting malicious activities. This research compares Random Forest (RF) and Support Vector Machines (SVM) in detecting intrusions using the UNSW-NB15 dataset. RF achieves 99.64% accuracy, with 4454 True Positives (TP), 4400 True Negatives (TN), 31 False Positives (FP), and 1 False Negative (FN). In contrast, SVM attains 78.87% accuracy, with 4422 TP, 2586 TN, 63 FP, and 1815 FN. The study also considers percentage changes in TP (0.72%), FP (-50.79%), FN (-99.94%), and TN (70.15%), providing insights into model adaptability. Validating RF with the Synthetic Minority Over-sampling Technique (SMOTE) yields 99.63% accuracy, compared to SVM’s 89%, indicating RF’s robustness with imbalanced datasets. RF’s superiority partly stems from its effective use of feature importance analysis, and its robustness to noise, maximizing the utility of selected features for better predictive performance compared to SVM which does not perform well with feature selection. This provides an understanding of RF and SVM strengths and limitations in network intrusion detection and underlines the importance of selecting appropriate machine learning models for network security applications concerning a particular kind of datase
Related links
Details
Title
A Comparative Analysis of Random Forest and Support Vector Machine Techniques on the UNSW-NB15 Dataset
Publication Details
Proceedings of the Third International Conference on Innovations in Computing Research (ICR’24), pp.194-203
Resource Type
Book chapter
Publisher
Springer Nature Switzerland; Cham
Series
Lecture Notes in Networks and Systems; volume 1058