A Survey of Random Forest Based Methods for Intrusion Detection Systems

By Paulo Angelo Alves Resende, André Costa Drummond. ACM Computing Surveys, 2018

335 citations recorded by the source corpus.

Over the past decades, researchers have been proposing different Intrusion Detection approaches to deal with the increasing number and complexity of threats for computer systems. In this context, Random Forest models have been providing a notable performance on their applications in the realm of the behaviour-based Intrusion Detection Systems. Specificities of the Random Forest model are used to provide classification, feature selection, and proximity metrics. This work provides a comprehensive review of the general basic concepts related to Intrusion Detection Systems, including taxonomies, attacks, data collection, modelling, evaluation metrics, and commonly used methods. It also provides a survey of Random Forest based methods applied in this context, considering the particularities involved in these models. Finally, some open questions and challenges are posed combined with possible directions to deal with them, which may guide future works on the area.

Subfields: Artificial Intelligence, Computer Networks and Communications, Signal Processing

View Paper: https://www.semanticscholar.org/paper/1bf6104035f311705ddf63e422dc12ea84aa2db6

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Networks and Communications

In Signal Processing

Citations in the corpus

Deep Reinforcement Learning for Cyber Security (2019, background): “nearest neighbors [87], [88], support vector machine (SVM) [87], [89], random forest [90] and recently deep learning [91], [92], however are normally relied on fixed features of existing cyber attacks so that they are deficient to detect new or deformed attacks.”
Internet of Things (IoT) Security Intelligence: A Comprehensive Overview, Machine Learning Solutions and Research Directions (2022, methodology): “Random forest technique is used to detect anomalies [39, 103], denial of service attack [41], IoT intrusion detection service [96, 106], smart city anomaly detection [28] etc.”
Explainable Artificial Intelligence Applications in Cyber Security: State-of-the-Art in Research (2022, neutral): “11 [22] 2018 N/A N/A √ √ N/A N/A √ ≈ √ ≈ √”
A review of ensemble learning and data augmentation models for class imbalanced problems: combination, implementation and evaluation (2023, methodology): “Furthermore, random forests have been widely used for network intrusion detection systems [80].”
A Review on Machine Learning and Deep Learning Perspectives of IDS for IoT: Recent Updates, Security Issues, and Challenges (2020, neutral): “An IDS is also developed for mobile ad-hoc networks in [102] for detecting faulty nodes and reducing the routing overhead in the networks.”
TON_IoT Telemetry Dataset: A New Generation Dataset of IoT and IIoT for Data-Driven Intrusion Detection Systems (2020, methodology): “Random Forest (RF) [66], [71] is an ensemble learning that combines multiple decision trees that use randomly picked data points as their input.”