An Intelligent Network Traffic Analysis Module for Intrusion Detection Systems Using an Ensemble of Neural Networks

Abstract

This paper presents a module for the intelligent analysis of network traffic for Intrusion Detection Systems (IDS), implemented as an ensemble of three artificial neural networks (ANNs): a Multi-Layer Perceptron (MLP), a Radial Basis Function (RBF) network, and a Self-Organizing Map (SOM). The problem is formalized as an optimization of two criteria: attack detection accuracy (Accuracy) and False Alarm Rate (FAR). An algorithm is proposed that allows for a flexible adjustment of the balance between these metrics depending on security policy priorities. Experiments on the UNSW-NB15 dataset demonstrated that the module achieves an accuracy of 97.2% with a FAR of 2.2% in a balanced mode, and an accuracy of 98.0% with a FAR of 3.6% in a maximum sensitivity mode. The results show the feasibility of adapting an IDS to specific operational conditions, which is particularly important for Security Operations Centers (SOCs), cloud service providers, and operators of critical infrastructure.