Discovering computer networks intrusion using data analytics and machine intelligence

TLDR

The rapid expansion of the Internet and IoT has heightened concerns about data theft and privacy, making intrusion detection systems a key defense against online security threats. This study compares an association‑rule based IDS using Apriori with an SVM‑based IDS to evaluate their effectiveness. The comparison was performed on the NSL‑KDD and UNSW‑NB15 datasets. Results show SVM achieves higher accuracy, whereas Apriori offers faster testing speed.

Abstract

In this era of a digital revolution, the use of the Internet for information storage, access, and dissemination has increased astronomically. Also, the advent of the Internet of Things (IoT) technologies has removed the digital barrier and accentuate the seamless exchange of data and information among many ubiquitous systems. Therefore, the challenge of information theft, privacy, and confidentiality of data and information over the internet has become a major quandary for many users of several online platforms. Network intrusion detection systems are one of the viable approaches to curb the menace of information theft and other data security threats over the internet. In this paper, we show a comparison between two intrusion detection systems–one that uses the association rule data mining approach–Apriori and the other that adapts the use of a machine learning technique–Support Vector Machine (SVM). The performance of the two systems was compared using the Network Security Laboratory Knowledge Discovery and Data Mining (NSL-KDD) dataset and the University of New South Wales–NB 2015 (UNSW-NB15) dataset. Evaluation results show that SVM performs better than Apriori in terms of accuracy, while Apriori gives a better performance in terms of testing speed.