Enhancement of Supervised Learning Models for Intrusion Detection Through Mutual Information and Hyperparameter Tuning

Abstract

Enhancing the performance of supervised learning algorithms through feature and hyperparameter testing remains challenging for users, particularly when detecting computer network intrusions. There are opportunities to assess whether a supervised learning algorithm performs optimally, depending on the number of features and the choice of hyperparameters. The purpose of this research is to enhance the network intrusion detection performance of three supervised learning algorithms, namely Support Vector Machine (SVM), eXtreme Gradient Boosting, and Random Forest, by using the Mutual Information feature selection approach and hyperparameter tuning. Mutual Information measures the dependency of features on the target. Features with high values are the most informative. Hyperparameters are not learned from the data; they are set before training begins. Hyperparameters are selected in accordance with the requirements of the three algorithms via iterative training and testing on the NSL-KDD dataset. The dataset was split into 80:20, 70:30, and 60:40. The results showed that the fifteen features with the highest mutual information were identified and trained on the data using appropriate hyperparameters. By splitting the data in an 80:20 ratio, the accuracy of Support Vector Machine reached its maximum, increasing from 90% to 98%. In contrast, eXtreme Gradient Boosting and Random Forest reached their maximum, increasing from 97% and 98% to 100%, respectively. The study’s findings advance our understanding of how algorithm performance depends on feature and hyperparameter selection.