Understanding Machine Learning Model Behavior for Intrusion Detection Across Attacks

Mehmet Erdi Özbek; Ece Gelal Soyak

Makale detayları

Understanding Machine Learning Model Behavior for Intrusion Detection Across Attacks

Yazarlar:

Mehmet Erdi Özbek | Ece Gelal Soyak

Yayıncı:

Murat YAKAR

Ana Başlıklar:

Information Security Management | Computer System Software | Computer Software

Dergi:

Turkish Journal of Engineering Vol.9 Issue 4, pp.768-778

Belge Tipi:

Makale

Yayın Tarihi:

8/2025

Belge Dili:

İngilizce

Document ID (Org No.):

2001360047

pISSN:

2587-1366

Anahtar kelimeler:

Özet:

 With the growing volume and variety of network traffic driven by various applications such as real-time communications and cloud services, combined with the increasing sophistication and frequency of malicious attempts, network administrators are facing greater challenges in securing their networks against malware. Over the past two decades, advances in machine learning and deep learning have led to a growing number of proposals for intelligent Network Intrusion Detection Systems NIDS that leverage these models to detect the unauthorized entry of security threats into the network. Existing studies focus on improving model accuracies, without a closer analysis of the underlying characteristics of the data. In this work, we analyze the effectiveness of NIDS mechanisms in different scenarios using different machine learning models. By examining classification performance across various data distributions -including scenarios with and without normal traffic and cases addressing class imbalance- we identify patterns in model behaviors and their correlation with attack characteristics. In our experiments, we have observed, i the kNN algorithm achieved the fastest training and testing times while maintaining adequate accuracy, ii XGBoost performed best in detecting the most commonly occurring attacks, iii MLP provided the highest improvement in minority class labels when resampling was applied in the dataset, and iv notably, while Reconnaissance attacks were consistently detected even with limited samples, detection of DoS attacks remained challenging with all models. We believe NIDS systems could benefit from the insights raised in this work based on the interplay between attack behaviors, data distributions, and model characteristics.

 With the growing volume and variety of network traffic driven by various applications such as real-time communications and cloud services, combined with the increasing sophistication and frequency of malicious attempts, network administrators are facing greater challenges in securing their networks against malware. Over the past two decades, advances in machine learning and deep learning have led to a growing number of proposals for intelligent Network Intrusion Detection Systems NIDS that leverage these models to detect the unauthorized entry of security threats into the network. Existing studies focus on improving model accuracies, without a closer analysis of the underlying characteristics of the data. In this work, we analyze the effectiveness of NIDS mechanisms in different scenarios using different machine learning models. By examining classification performance across various data distributions -including scenarios with and without normal traffic and cases addressing class imbalance- we identify patterns in model behaviors and their correlation with attack characteristics. In our experiments, we have observed, i the kNN algorithm achieved the fastest training and testing times while maintaining adequate accuracy, ii XGBoost performed best in detecting the most commonly occurring attacks, iii MLP provided the highest improvement in minority class labels when resampling was applied in the dataset, and iv notably, while Reconnaissance attacks were consistently detected even with limited samples, detection of DoS attacks remained challenging with all models. We believe NIDS systems could benefit from the insights raised in this work based on the interplay between attack behaviors, data distributions, and model characteristics.

 With the growing volume and variety of network traffic driven by various applications such as real-time communications and cloud services, combined with the increasing sophistication and frequency of malicious attempts, network administrators are facing greater challenges in securing their networks against malware. Over the past two decades, advances in machine learning and deep learning have led to a growing number of proposals for intelligent Network Intrusion Detection Systems NIDS that leverage these models to detect the unauthorized entry of security threats into the network. Existing studies focus on improving model accuracies, without a closer analysis of the underlying characteristics of the data. In this work, we analyze the effectiveness of NIDS mechanisms in different scenarios using different machine learning models. By examining classification performance across various data distributions -including scenarios with and without normal traffic and cases addressing class imbalance- we identify patterns in model behaviors and their correlation with attack characteristics. In our experiments, we have observed, i the kNN algorithm achieved the fastest training and testing times while maintaining adequate accuracy, ii XGBoost performed best in detecting the most commonly occurring attacks, iii MLP provided the highest improvement in minority class labels when resampling was applied in the dataset, and iv notably, while Reconnaissance attacks were consistently detected even with limited samples, detection of DoS attacks remained challenging with all models. We believe NIDS systems could benefit from the insights raised in this work based on the interplay between attack behaviors, data distributions, and model characteristics.

 With the growing volume and variety of network traffic driven by various applications such as real-time communications and cloud services, combined with the increasing sophistication and frequency of malicious attempts, network administrators are facing greater challenges in securing their networks against malware. Over the past two decades, advances in machine learning and deep learning have led to a growing number of proposals for intelligent Network Intrusion Detection Systems NIDS that leverage these models to detect the unauthorized entry of security threats into the network. Existing studies focus on improving model accuracies, without a closer analysis of the underlying characteristics of the data. In this work, we analyze the effectiveness of NIDS mechanisms in different scenarios using different machine learning models. By examining classification performance across various data distributions -including scenarios with and without normal traffic and cases addressing class imbalance- we identify patterns in model behaviors and their correlation with attack characteristics. In our experiments, we have observed, i the kNN algorithm achieved the fastest training and testing times while maintaining adequate accuracy, ii XGBoost performed best in detecting the most commonly occurring attacks, iii MLP provided the highest improvement in minority class labels when resampling was applied in the dataset, and iv notably, while Reconnaissance attacks were consistently detected even with limited samples, detection of DoS attacks remained challenging with all models. We believe NIDS systems could benefit from the insights raised in this work based on the interplay between attack behaviors, data distributions, and model characteristics.

Makale detayları

Understanding Machine Learning Model Behavior for Intrusion Detection Across Attacks

Yazarlar:

Mehmet Erdi Özbek | Ece Gelal Soyak

Yayıncı:

Murat YAKAR

Ana Başlıklar:

Information Security Management | Computer System Software | Computer Software

Dergi:

Turkish Journal of Engineering Vol.9 Issue 4, pp.768-778

Belge Tipi:

Makale

Yayın Tarihi:

8/2025

Belge Dili:

İngilizce

Document ID (Org No.):

2001360047

pISSN:

2587-1366

intrusion detection systems

machine learning

malware classification

attack behavior

cybersecurity

system security

information security

Sayı

Makale detayları

Yazarlar: Mehmet Erdi Özbek | Ece Gelal Soyak

Yayıncı: Murat YAKAR

Ana Başlıklar: Information Security Management | Computer System Software | Computer Software

Dergi: Turkish Journal of Engineering Vol.9 Issue 4, pp.768-778

Belge Tipi: Makale

Yayın Tarihi: 8/2025

Belge Dili: İngilizce

Document ID (Org No.): 2001360047

pISSN: 2587-1366

Sayı

Yazarlar:

Mehmet Erdi Özbek | Ece Gelal Soyak

Yayıncı:

Murat YAKAR

Ana Başlıklar:

Information Security Management | Computer System Software | Computer Software

Dergi:

Turkish Journal of Engineering Vol.9 Issue 4, pp.768-778

Belge Tipi:

Makale

Yayın Tarihi:

8/2025

Belge Dili:

İngilizce

Document ID (Org No.):

2001360047

pISSN:

2587-1366