A Hybrid Binary and Multi-Class Classification Model for Network Intrusion Detection

Intrusion detection is a cornerstone in computer networks, maintaining privacy and ensuring availability and security. However, the larger the number of features involved in the intrusion detection process, the more complex it becomes. Therefore, reducing the number of features is necessary. Feature selection techniques can effectively enhance the classifiers' performance by eliminating redundant or irrelevant features. Two powerful models were introduced for anomaly-based intrusion detection based on a binary classifier and a multi-classifier, which both depend on a modified firefly algorithm (FFA) for feature selection. Support Vector Machine (SVM) and K-Nearest Neighbour classifiers have been used to evaluate both models over the NSL-KDD dataset. The first and second models have been used for attack classification to distinguish between normal and abnormal traffic, and between four types of attacks, including Denial of Service Attack (DoS), User to Root Attack (U2R), Remote to Local Attack (R2L), Probing Attack, and the normal case, respectively. The models were evaluated for classification accuracy and the number of features. The first model achieved 98% accuracy with 7 selected features, while the second achieved 97% accuracy with 11 selected features.