Machine Learning Based Intrusion Detection System for Cyberattacks on Corporate Networks

Abstract

Business organizations have benefited significantly from technology explosion that resulted in a rapid expansion of their computer network infrastructure. This led to the introduction of new vulnerabilities that could be exploited by cyber attackers to gain unauthorized entry into corporate networks resulting in data theft and other related threats. These threats include, but are not limited to, ransomware, credential misuse, and data breaches. All these attacks are significant in terms of the resources required for rectification efforts, and the resulting reputational damage caused to organizations. Cyberattacks target corporate networks, which maintain their customers’ personally identifiable information (PII) for day-to-day operations, thus causing data theft, reputation, and financial losses. This praxis research provided a machine learning (ML)-based intrusion detection system (IDS) to detect and classify a potential cyberattack, based on network traffic analysis. The IDS can be implemented on a server that monitors the network traffic. This praxis research used a portion from the network traffic data set that is over 16.5 GB in size with over nine (9) million records of simulated network traffic that includes Packet size, Source and Destination IP (Internet Protocol) Addresses. Random Forest, eXtreme Gradient Boosting, k-Nearest Neighbor were the primary ML models studied.