Design and Development of an Efficient Network Intrusion Detection System Using Machine Learning Techniques

Table 9

Probe attack evaluated with hybrid NID-Shield NIDS approach without stacking.

(a)

Total instances	15,738
Correctly classified instances	15,685
Incorrectly classified instances	53
Execution time	4.23 seconds
Kappa measures	0.9872
MAE	0.0034
RMSE	0.0343
RAE	3.1818%
RRSE	14.9173%

(b)

Accuracy		TP rate	FP rate	Precision	Recall	-measure	MCC	ROC area	PRC area	Class
99.9%		0.999	0.016	0.997	0.999	0.998	0.988	1.000	1.000	normal
99.3%		0.993	0.000	1.000	0.993	0.997	0.996	0.999	0.998	portsweep
96.8%		0.968	0.000	0.999	0.968	0.983	0.982	0.999	0.996	satan
99.3%		0.993	0.001	0.989	0.993	0.991	0.990	1.000	0.996	ipsweep
95.3%		0.953	0.000	0.976	0.953	0.965	0.964	0.998	0.992	nmap
Weighted Avg.	99.7%	0.997	0.014	0.997	0.997	0.997	0.988	1.000	0.999

(c)

Confusion matrix
13441	0	1	0	3
2	593	0	0	0
4	0	679	1	2
2	0	0	718	2
0	0	0	3	287

—classified as normal, —classified as portsweep, —classified as satan, —classified as ipsweep, and —classified as nmap.