Performance Evaluation of Decision Tree and Random Forest Algorithms for IDS

Abstract

Increasing complexity and frequency of cyberattacks pose a serious threat to modern network infrastructure, making intrusion detection systems (IDS) crucial for maintaining cybersecurity. Conventional IDSs often struggle to identify novel and sophisticated attack patterns, necessitating an adaptive machine learning approach. This study evaluates and compares the performance of Random Forest and Decision Tree algorithms for network intrusion detection using the KDD Cup 99 dataset. This dataset contains both normal network traffic and various categories of cyberattacks, making it suitable for IDS evaluation. The proposed methodology consists of three stages: data preprocessing, model training, and performance evaluation. Model performance is assessed using accuracy, precision, recall, and F1-score metrics. Experimental results show that RF outperforms DT in most evaluation measures. RF achieves an accuracy of 0.88, a precision of 0.98, a recall of 0.74, and an F1-score of 0.84, while DT achieves an accuracy of 0.82, a precision of 0.80, a recall of 0.80, and an F1-score of 0.80. Furthermore, RF demonstrated better generalization capabilities when handling imbalanced data. These findings demonstrate that ensemble-based methods provide a robust and reliable solution for developing accurate IDSs and improving overall network security performance.