Development and Validation of Dataset for Intrusion Detection System over Real Traffic

Intrusion Detection System (IDS) are monitoring devices to help network and system administrators identify any sort of abnormal activity within a network such as malware, malicious attacks or intrusions. Due to significant increase in unusual traffic activities, IDS has caught the attention of many researchers to enhance its performance. Although, there has been studies using Machine Learning (ML) based IDS models, however, there is still dire need for updated, authentic, and reliable dataset. Moreover, finding a right dataset based on user's requirement is a challenging task itself. A major problem with available datasets is outdated contents and are limited to few network attacks. In our work, we propose a method to help practitioners create their custom dataset to include updated real traffic with wide range of attacks based on user's requirement. Performance of several ML based IDS such as Support Vector Machine (SVM), Decision Tree (DT), Naive Bayes is compared using existing as well as on our own custom dataset. Various experiments have been conducted to evaluate the performance of ML based IDS using balanced and unbalanced dataset. The dataset is balanced using under sampling technique and is validated using cross and split validation techniques. The results suggest improvements compared to existing ML based IDS models reported in literature.