Análise Comparativa de Técnicas de Aprendizado de Máquina para Detecção de Intrusões em Redes no Conjunto de Dados CICIDS2017

Abstract

This work presents the analysis and comparison of Machine Learning models in the context of a Network Intrusion Detection System, using the CICIDS2017 dataset. For this purpose, the Random Forest (RF) and Multi-Layer Perceptron (MLP) models were evaluated, combined with dimensionality reduction techniques, such as Principal Component Analysis (PCA) and Mean Decrease in Impurity (MDI). The MDI technique resulted in a reduction from 70 to 51 features, while the PCA technique resulted in a reduction from 70 to 33 features. The models were validated using the Stratified K-Fold Cross-Validation technique, and performance metrics, such as weighted precision, weighted recall, and weighted F1-Score, were used to evaluate the results. Tests with different values ​​of n_estimators in RF revealed that 25 trees provide the best balance between performance and computational efficiency, with a weighted F1-Score of approximately 0.9981 and taking only 8.7 minutes to train the model. MLP achieved a weighted F1-Score of approximately 0.9959 and taking 13.1 minutes to train the model.