Machine Learning Techniques for Intrusion Detection

TL;DR

This paper reviews machine learning techniques for intrusion detection, highlighting their potential to improve detection rates and reduce false alarms in dynamic cyber attack environments.

Contribution

It compares classical AI and computational intelligence methods for IDS, explaining how CI techniques can enhance detection efficiency.

Findings

Machine learning improves IDS performance.

CI techniques offer adaptable detection methods.

Comparison of different ML schemes for IDS.

Abstract

An Intrusion Detection System (IDS) is a software that monitors a single or a network of computers for malicious activities (attacks) that are aimed at stealing or censoring information or corrupting network protocols. Most techniques used in today's IDS are not able to deal with the dynamic and complex nature of cyber attacks on computer networks. Hence, efficient adaptive methods like various techniques of machine learning can result in higher detection rates, lower false alarm rates and reasonable computation and communication costs. In this paper, we study several such schemes and compare their performance. We divide the schemes into methods based on classical artificial intelligence (AI) and methods based on computational intelligence (CI). We explain how various characteristics of CI techniques can be used to build efficient IDS.