Two-Stages Intrusion Detection System Based On Hybrid Methods

Abstract

As network traffic grows on an almost a daily basis, attacks and intrusions will keep develop with it. Thus, countering network attacks will require more research on updated datasets. Therefore, Intrusion Detection Systems must follow the recent updates and keep evolving to be able to detect modern attacks. In this paper, we introduce a new two-stage hybrid IDS model using different classifiers to detect attacks from normal traffic. In the first stage, we binary classify traffic between Normal/Attack, while in the second stage we pass traffic records that have been classified as attacks to a second classifier, which will identify attack's type. We used CICIDS2017 dataset to validate our model, which contains the most up-to-date attacks such as DDoS and Web Attacks, along with the well-know NSL-KDD to prove our model further more. The proposed model reported a very promising results, high accuracy and detection rate with very low false positive rate.