An Intrusion Detection Approach Based on Decision Tree-Principal Component Analysis Over CICIDS2017

Abstract

In today's environment, an Intrusion Detection System (IDS) is becoming increasingly crucial in a network's Defense System to protect our network from any external threats or attack. The primary function of an IDS is to offer a shield for a specific host or network, as well as to examine and forecast client network access activities. The entire traffic is classified as normal or an assault based on these patterns. In order to classify traffic as valid or malicious, IDS must process all incoming communication over networks. As a result, IDS must cope with significant or enormous amounts of data. However, in IDS, not all features may be required to be processed among this data. As a result, extracting or locating the only relevant features among all features is always challenging. To address this issue, we have proposed a feature selection technique using Principal component analysis with Decision tree algorithm (DT-PCA) over real-time datasets, i.e., (CICIDS2017). The proposed classifier (Decision Tree) employing Principal component analysis performed well over CICIDS2017 datasets, according to the results presented in this research. To measure the performance or efficiency of the method, the most important metrics namely, recall, F-measure, precision, and accuracy have been used in this paper. In addition, this research examines the differences between DT-PCA and DT with all features. According to the CICIDS2017 datasets, the DT-PCA approaches can improve the IDS's performance and the accuracy rate can be achieved more than 99%.