Improving the Reliability of Network Intrusion Detection Systems Through Dataset Integration

Abstract

This work presents Reliable-NIDS (R-NIDS), a novel methodology for Machine Learning (ML) based Network Intrusion Detection Systems (NIDSs) that allows ML models to work on integrated datasets, empowering the learning process with diverse information from different datasets. We also propose a new dataset, called UNK22. It is built from three of the most well-known network datasets (UGR'16, USNW-NB15 and NLS-KDD), each one gathered from its own network environment, with different features and classes, by using a data aggregation approach present in R-NIDS. Therefore, R-NIDS targets the design of more robust models that generalize better than traditional approaches. Following R-NIDS, in this work we propose to build two well-known ML models for reliable predictions thanks to the meaningful information integrated in UNK22. The results show how these models benefit from the proposed approach, being able to generalize better when using UNK22 in the training process, in comparison to individually using the datasets composing it. Furthermore, these results are carefully analyzed with statistical tools that provide high confidence on our conclusions. Finally, the proposed solution is feasible to be deployed in network production environments, not usually taken into account in the literature.