Boosting algorithms for network intrusion detection: A comparative evaluation of Real AdaBoost, Gentle AdaBoost and Modest AdaBoost

Computer networks have been experienced ever-increasing growth since they play a critical role in different aspects of human life. Regarding the vulnerabilities of computer networks, they should be monitored regularly to detect intrusions and attacks by using high-performance Intrusion Detection Systems (IDSs). IDSs try to differentiate between normal and abnormal behaviors to recognize intrusions. Due to the complex behavior of malicious entities, it is crucially important to adopt machine learning methods for intrusion detection with a fine performance and low time complexity. Boosting approach is considered as a way to deal with this challenge. In this paper, we prepare a clear summary of the latest progress in the context of intrusion detection methods, present a technical background on boosting, and demonstrate the ability of the three well-known boosting algorithms (Real Adaboost, Gentle Adaboost, and Modest Adaboost) as IDSs by using five IDS public benchmark datasets. The results show that the Modest AdaBoost has a higher error rate compared to Gentle and Real AdaBoost in IDSs. Besides, in the case of IDSs, Gentle and Real AdaBoost show the same performance as they have about 70% lower error rates compared to Modest Adaboost, however, Modest AdaBoost is about 7% faster than them. In addition, as IDSs need to retrain the model frequently, the results show that Modest AdaBoost has a much lower performance than Gentle and Real AdaBoost in case of error rate stability.