Intelligent Intrusion Detection Using Decision Trees and the NSL-KDD Dataset: An All-Inclusive Method for Cyber Attack Detection

Abstract

The rapid advancement of technology and widespread internet usage have resulted in a significant increase in cyber threats, compromising sensitive information, and posing risks to organizations. Traditional security measures are inadequate against the complex nature of such attacks, revealing the urgent need for advanced security solutions. In response, security experts are developing innovative tools that leverage artificial intelligence to enhance intrusion detection. This paper introduces a novel intrusion detection system (IDS) that uses decision tree algorithms to detect and classify anomalous network traffic patterns in real time. The system focuses on identifying four main types of attacks: Denial of Service (DoS), Probe, Root to Local (R2L), and User to Root (U2R). By analyzing normal network behavior, the IDS can detect such attacks promptly, thereby improving the overall network security and resilience. The proposed model was built on the NSL-KDD reference database and demonstrated remarkable performance, achieving an accuracy of 99.20%, precision of 95.63%, recall of 96.89%, and an F-measure of 96.14, outperforming existing methodologies. In addition, the evaluation encompasses various metrics, highlighting enhanced detection capabilities compared to traditional approaches. The incorporation of recursive feature elimination (DT-RFE) and stacking fusion significantly improves detection accuracy while reducing false positives. Overall, the proposed IDS presents a robust solution to combat evolving cyber threats, addressing the growing demand for effective and reliable cybersecurity measures.