Detection of Web-Based Attacks using Tree-Based Learning Models: An Evaluation Study

Abstract

Due to the increasing complexity of web-based attacks, their detection has become more challenging in recent years. Relying solely on traditional intrusion detection systems may no longer suffice. Recent research highlights the necessity of adopting machine learning techniques to prevent and detect attacks. To address this, the authors of this study employed the CIC-IDS 2017 dataset and utilized the GridSearchCv algorithm for fine-tuning hyperparameters. This research primarily focuses on evaluating tree-based learning algorithms for web-based attack detection. Specifically, the three most widely used supervised learning algorithms-Decision Tree, Random Forest, and XGBoost-were examined. The experimental outcomes showcased the superiority of the XGBoost classifier over the Random Forest and Decision Tree classifiers in multiple performance metrics. These metrics encompass accuracy, recall, F-value, and false negative rate (FNR), achieving values of 99.994%, 99.550%, 99.774%, and 0.45%, respectively. Regarding precision and false positive rate (FPR), the authors observed that both XGBoost and Random Forest outperformed the Decision Tree classifier. Notably, XGBoost and Random Forest achieved values of 100% precision and 0% FPR, respectively. It’s worth mentioning that the Decision Tree classifier demonstrated quicker training and testing processes compared to the other classifiers.

Yassine Sadqi—These authors contributed equally to this work.