SVM and KNN Algorithms' Performance Comparison for Network Intrusion Detection system “IDS”

Abstract

As communication and internet technology improve, network infrastructures are facing traffic volumes that are increasing exponentially, as well as more sophisticated cyber attacks. In these circumstances, the role of intrusion detection systems (IDS) has become even more critical. Recently, the popularity of machine learning has increased. Algorithms have been adopted to help improve the detection of malicious activities by recognizing complex patterns in data traffic. This study investigates the effectiveness of machine learning methods, K-Nearest Neighbors (KNN) and Support Vector Machines (SVM), in intrusion detection by using the NSL-KDD dataset. It first introduces both methods. The test results show that SVM achieves better results than KNN in detecting attack activities and in terms of overall accuracy (85.08% compared to 83.57%). SVM also achieves better results in the detection of DoS, Probe, and Normal traffic attacks. For Probe attack detection, SVM KNN (0.816) when it comes to the F1-score, and KNN is 0.713. On the other hand, KNN showed excellent performance while identifying DoS attacks (F1 = 0.985), but its performance was less stable across other classes. Still, both systems exhibited significant shortcomings when identifying rare attack types such as R2L and U2R, with recall values less than 0.12. These outcomes indicate that the more significant generalization and more prominent capability to deal with complex data distributions of SVM positions it as the optimal basic machine learning technique for IDS among the rest. etc. Nevertheless, the persistent challenges with the recognition of low frequency attack types show that data rebalancing techniques and/or combined models will be needed in later studies. This would improve the scope and trust of intrusion detection systems, thus providing more robust defenses.