KC-IDS : Multi-layer Intrusion Detection System

In the big data era, machine learning is expected to be a promising solution for intrusion detection. However, most existing machine learning based Intrusion Detection Systems (IDSs) are not satisfactory in performing the multiclass intrusion detection task in the case when traffic data are imbalanced. In this paper, a multi-layer intrusion detection system named KC-IDS is proposed, which aims to improve the detection performance of multi-class classification task. The motivation of KC-IDS is to predict different kinds of traffic in different layers and combine the advantages of k-Nearest Neighbors (kNN) and Categorical Boosting (CatBoost) to alleviate the effects of imbalanced data. Experimental results on KDD99 dataset verified that KC-IDS can achieve better detection performance compared with some existing machine learning methods.