Improving intrusion detection model prediction by threshold adaptation

Amjad M. Al Tobi*, Ishbel Duncan

*Corresponding author for this work

Research output: Contribution to journalArticlepeer-review

11 Citations (Scopus)


Network traffic exhibits a high level of variability over short periods of time. This variability impacts negatively on the accuracy of anomaly-based network intrusion detection systems (IDS) that are built using predictive models in a batch learning setup. This work investigates how adapting the discriminating threshold of model predictions, specifically to the evaluated traffic, improves the detection rates of these intrusion detection models. Specifically, this research studied the adaptability features of three well known machine learning algorithms: C5.0, Random Forest and Support Vector Machine. Each algorithm's ability to adapt their prediction thresholds was assessed and analysed under different scenarios that simulated real world settings using the prospective sampling approach. Multiple IDS datasets were used for the analysis, including a newly generated dataset (STA2018). This research demonstrated empirically the importance of threshold adaptation in improving the accuracy of detection models when training and evaluation traffic have different statistical properties. Tests were undertaken to analyse the effects of feature selection and data balancing on model accuracy when different significant features in traffic were used. The effects of threshold adaptation on improving accuracy were statistically analysed. Of the three compared algorithms, Random Forest was the most adaptable and had the highest detection rates.

Original languageEnglish
Article number159
JournalInformation (Switzerland)
Issue number5
Publication statusPublished - 2019


  • Anomaly-based IDS
  • C5.0
  • Intrusion Detection System
  • Machine Learning
  • Prediction accuracy improvement
  • Random Forest
  • STA2018 dataset
  • Support Vector Machine
  • Threshold adaptation

ASJC Scopus subject areas

  • Information Systems


Dive into the research topics of 'Improving intrusion detection model prediction by threshold adaptation'. Together they form a unique fingerprint.

Cite this