NIDS-CNNRF integrating CNN and random forest for efficient network intrusion detection model

Abstract

Network intrusion detection is crucial for enhancing network security; however, existing models face three prominent challenges. First, many models place too much emphasis on overall accuracy, often neglecting the accurate distinction between different types of attacks. Second, due to feature redundancy in complex high-dimensional attack traffic, these models struggle to extract key information from large feature sets. Lastly, when dealing with imbalanced datasets, models tend to focus on learning from classes with larger sample sizes, thus overlooking those with fewer instances. To address these issues, this paper proposes a novel network intrusion detection model, NIDS-CNNRF. This model integrates Convolutional Neural Networks (CNN) for feature extraction and Random Forest (RF) for classifying attack traffic, enabling precise identification of various attack types. The Adaptive Synthetic Sampling (ADASYN) algorithm is employed to mitigate the bias toward classes with larger sample sizes, while Principal Component Analysis (PCA) is used to address feature redundancy, allowing the model to effectively extract key information. Experimental results demonstrate that the NIDS-CNNRF model significantly outperforms traditional intrusion detection models in enhancing network security, with superior performance observed on the KDD CUP99, NSL_KDD, CIC-IDS2017, and CIC-IDS2018 datasets.