Authors: Dr.Kousar Jaha Begum
Abstract: Advancements in complexity of cybersecurity threats have shown limitations in detection capabilities of signature-based IDS systems, including lack of detection of zero-day attacks and polymorphic malware. One can use statistical methods to address this issue, using statistical methods for modeling and detecting deviation of the characteristics of network data from established baseline values. This research presents a hybrid IDS method using three different statistical approaches to detect cybersecurity threats, namely: entropy-based distributional analysis of volumetric anomalies; isolation of outliers in feature space via the use of Isolation Forest algorithm; supervised classification of attack types using Random Forest classifier. The proposed framework is tested on the CICIDS2017 and NSL-KDD benchmark datasets. The results show that hybrid model demonstrates precision of 0.941, recall of 0.928 and F1 score of 0.934 on the CICIDS2017 dataset, which is superior to other standalone statistical methods and comparable machine learning algorithms.
DOI:
