Assimilate Grid Search and ANOVA Algorithms into KNN to Enhance Network Intrusion Detection Systems

Abstract

The recent progress of operational network intrusion detection systems (NIDS) has become increasingly essential. Herein, a fruitful attempt to introduce an innovative NIDS methodology that integrates the grid search optimization algorithm and ANOVA techniques with the K nearest neighbor (KNN) algorithm to analyze both spatial and temporal characteristics of data for network traffic. We employ the UNSW-NB15 benchmark dataset, which presents various patterns and a notable imbalance between the training and testing data, with 257674 samples. Therefore, the Synthetic Minority Oversampling Technique has been used since this method is effective in handling imbalanced datasets. Further, to handle the overfitting issue the K folds cross-validation method has been applied. The feature sets within the dataset are meticulously selected using ANOVA mechanisms. Subsequently, the KNN classifier is fine-tuned through hyperparameter tuning using the grid search algorithm. This tuning process includes adjusting the number of K neighbors and evaluating various distance metrics such as 'euclidean', 'manhattan', and 'minkowski'. Herein, all attack types in the dataset were labeled as either 1 for abnormal instances or 0 for normal instances. Our model excels in binary classification by harnessing the strengths of these integrated techniques. By conducting extensive experiments and benchmarking against cutting-edge machine learning and deep learning models, the effectiveness and advantages of our proposed approach are thoroughly demonstrated. Achieving an impressive performance of 99.1%. Also, several performance metrics have been applied to assess the proposed model's efficiency.