Hibridación de modelos supervisados para la detección de intrusiones en redes de comunicación

Abstract

The present work evaluated the performance of a hybrid Machine Learning (ML) model in the context of an anomaly-based Intrusion Detection System (IDS). For this purpose, the CIC-IDS2017 dataset was used, which includes a representative variety of contemporary attacks such as DDoS, Infiltration, and Botnet, as well as benign traffic. Random Forest (RF) and K Nearest Neighbors (KNN) algorithms were selected and combined, and compared with individual models such as Support Vector Machine (SVM), XGBoost, and Multi-Layer Perceptron (MLP), following the CRISP-DM methodology. The process included data cleaning, variable encoding, and class balancing using the Synthetic Minority Over-Sampling Technique (SMOTE), applied exclusively to the training sets generated by cross-validation. The models were evaluated using metrics such as Accuracy, Recall, F1-Score, Precision, and ROC-AUC. As a result, the hybrid model based on soft voting achieved an F1-Score of 99.43%, outperforming the individual algorithms. This performance demonstrated the capability of the proposed approach to detect rare attacks while maintaining a balance between performance and computational efficiency, as reflected in the consistency of the results obtained across different validation sets.