Edinburgh Napier University

  Intrusion detection systems (IDS) have developed and evolved over time to form an important component in network security. The aim of an intrusion detection system is to successfully detect intrusions within a network and to trigger alerts to system administrators. Machine learning is a method of detecting patterns in sets of data in order that such patterns can be recognised in new unseen data. This method can be employed by intrusion detection systems whereby datasets that contain attacks can be used to train machine learning models, which in turn facilitates the implementation of such models to detect identical attacks in previously unseen data. This paper compares various machine learning algorithms using binary, multiclass and ensemble-based classification on the KDD CUP 99 and CICIDS 2017 datasets. This paper also makes comparisons between full and reduced features. Findings conclude that the Random Forest machine learning algorithm produces high accuracy in all experiments. Random Forest was able to provide efficient execution times which benefits from the reduced features.