A two-layered collaborative approach for network intrusion detection system using blended shallow learning gaussian naïve bayes and support vector machine models

Pardeshi, Nilesh Ghanshyam
Patil, Dipak Vitthalrao

International Journal of Advances in Intelligent Informatics
Vol 11, No 3 (2025): August 2025

The majority of network intrusion detection systems use a signature matching technique. To detect abnormalities and unfamiliar attacks using machine learning methods is a more reliable approach. However, due to significant variations in attack trends, applying a single classifier is impractical for the effective detection of all types and forms of attacks, particularly rare attacks such as User2Root (U2R) and Remote2Local (R2L). Consequently, a hybrid strategy is expected to provide more promising performance. The proposed Two-Layered Collaborative Approach (TLCA) particularly addresses the problem as mentioned earlier. Principal Component Analysis optimizes variables to handle the variation resulting from every kind of attack. The proposed method investigates several types of attacks and discovered that the behaviors of U2R and R2L attacks are similar to those of regular users’ characteristics. To identify DoS and Probe attacks, TLCA uses a Shallow Learning classifier, such as Gaussian Naïve Bayes, as Layer 1. Similarly, the Support Vector Machine at Layer 2 discriminates between U2R and R2L and typical occurrences. We have divided KDDTrain+ into Set 1 and Set 2 by observing that it involves two 2-dimensional PCA analyses. Cross-sectional Correlated Feature Selection (CCFS) is employed to choose key attributes. PCA and KPCA are applied to datasets to reduce dimensionality. The results obtained using the proposed method on the NSL-KDD dataset are compared with those of available benchmark methods. According to the experimental data, TLCA outperforms all single machine learning classifiers and surpasses many current cutting-edge IDS approaches. The proposed method achieves detection rates of 92.4%, 92.3%, 95.6%, and 100% for DoS, Probe, R2L, and U2R, respectively. The proposed TLCA also demonstrates a better ability to identify unusual attacks. It also yields improved detection rate results for known attacks, at 94.1%, and for unknown attacks, at 91.1%, when using the KDDTest+ dataset for testing.