Flow-Based Network Intrusion Detection System Using Decision Tree Over Big Data

Abstract

In computer networks with constantly increasing traffic volumes, flow-based NIDS is the best option for detecting intrusion attempts. In recent years, different machine learning algorithms have been used to detect intrusions in the network. Some of these algorithms showed outstanding performance but are time-consuming and costly. To overcome these problems, Decision Tree has been proposed. In this research, Decision Tree have been used to identify known and unknown attacks on traffic. It executes decision rules in real-time while creating a tree model. That's why it is time-saving. Random Forest, Support Vector Machine, Naive Bayes, Artificial Neural Network, and Deep Neural Network also have been used to show comparison with the Decision Tree. Obtaining a promising result on the dataset "LUFlow" from Lancaster University, we concluded Decision Tree could be used as an intrusion detection model.