Evaluation Framework for ML-based IDS

Solayman Ayoubi (1) , Gregory Blanc (2, 3, 4) , Houda Jmila (2, 3, 4) , Sébastien Tixeuil (5, 6) , Thomas Silverston (7)

1 LORIA - Laboratoire Lorrain de Recherche en Informatique et ses Applications
2 IP Paris - Institut Polytechnique de Paris
3 TSP - RS2M - Département Réseaux et Services Multimédia Mobiles
4 SCN-SAMOVAR - Sécurité et Confiance Numérique
5 NPA - Networks and Performance Analysis
6 IUF - Institut universitaire de France
7 SIMBIOT - SIMulating and Building IOT

Intrusion detection is an important topic in cybersecurity research, but the evaluation methodology has remained stagnant despite advancements including the use of machine learning. In this paper, we design a comprehensive evaluation framework for Machine Learning (ML)-based IDS and take into account the unique aspects of ML algorithms, their strengths, and weaknesses. The framework design is inspired by both i) traditional IDS evaluation methods and ii) recommendations for evaluating ML algorithms in diverse application areas. Data quality being the key to machine learning, we focus on datadriven evaluation by exploring data-related issues.

Mots clés: Intrusion Detection System Machine Learning Data-driven Evaluation Evaluation Framework; Intrusion Detection System; Machine Learning; Data-driven Evaluation; Evaluation Framework

Domaines: Ordinateur et société [cs.CY]

Solayman Ayoubi, Gregory Blanc, Houda Jmila, Sébastien Tixeuil, Thomas Silverston. Evaluation Framework for ML-based IDS. RESSI 2023 : Rendez-vous de la Recherche et de l'Enseignement de la Sécurité des Systèmes d'Information, May 2023, Neuvy-sur-Barangeon, France. ⟨hal-04164441⟩