Addressing the class imbalance problem in network intrusion detection systems using data resampling and deep learning

Abstract

Network intrusion detection systems (NIDS) are the most common tool used to detect malicious attacks on a network. They help prevent the ever-increasing different attacks and provide better security for the network. NIDS are classified into signature-based and anomaly-based detection. The most common type of NIDS is the anomaly-based NIDS which is based on machine learning models and is able to detect attacks with high accuracy. However, in recent years, NIDS has achieved even better results in detecting already known and novel attacks with the adoption of deep learning models. Benchmark datasets in intrusion detection try to simulate real-network traffic by including more normal traffic samples than the attack samples. This causes the training data to be imbalanced and causes difficulties in detecting certain types of attacks for the NIDS. In this paper, a data resampling technique is proposed based on Adaptive Synthetic (ADASYN) and Tomek Links algorithms in combination with different deep learning models to mitigate the class imbalance problem. The proposed model is evaluated on the benchmark NSL-KDD dataset using accuracy, precision, recall and F-score metrics. The experimental results show that in binary classification, the proposed method improves the performance of the NIDS and outperforms state-of-the-art models with an achieved accuracy of 99.8%. In multi-class classification, the results were also improved, outperforming state-of-the-art models with an achieved accuracy of 99.98%.

RETRACTED: Enhancing Multi-Class Intrusion Detection through Hybrid Auto Encoder-Deep Neural Network Classifiers: A Comprehensive Analysis of Class Imbalance Mitigation Strategies Using Data Resampling Techniques

“…The writers of [33] also recommended a CNN in order to reach 93.2%. In order to attain an accuracy of 87.25, the authors in [34] recommended use a CNN. This work addresses the issue of class imbalance by presenting a number of deep learning models and a data resampling method based on the tomek links and ADASYN algorithms.…”

Unbalanced Web Phishing Classification through Deep Reinforcement Learning

“…The investigation proposed in [37] extends the analysis using other techniques such as adaptive synthetic (ADASYN), Tomek-Link (T-Link), and T-Link with ADASYN combined with DL models, such as MLP, CNN, and a combination between a CNN and a particular type of recurrent neural network (RNN), that is, a BiLSTM. Furthermore, the evaluation of sampling techniques is extended, considering the combination between random undersampling (RUS) and random oversampling (ROS).…”

Deep-IDS: A Real-Time Intrusion Detector for IoT Nodes Using Deep Learning

“…D. Musleh et al [18] innovatively applied feature extraction techniques using VGG-16 and DenseNet on intrusion datasets and, through the employment of ML models such as Random Forest, K-Nearest Neighbors, and Support Vector Machine (SVM), achieved an accuracy of 92.40%. Other notable IDSs, including those developed by G. Logeswari et al [19], J. O. Mebawondu et al [20], and A. Abdelkhalek et al [21], have reported accuracies of 82.20%, 76.96%, and 83.50%, respectively. Moreover, the Secured Automatic Two-level Intrusion Detection System (SATIDS) introduced by A. R. Elsayed et al [22] showcases a remarkable accuracy of 96.56%.…”

“…Notably, G. Logeswari et al[19], and J. O. Mebawondu et al[20] presented systems with significantly lower overall performance metrics, highlighting the advanced capabilities of Deep-IDS in handling various intrusion types effectively. A. R. Elsayed et al[21] and P. Kumar et al[23] also proposed systems with high accuracy rates of 96.56% and 97.45%, respectively, but neither matched the balanced performance across all metrics achieved by Deep-IDS. This comparison underscores the robustness and efficiency of Deep-IDS in…”