ConFlow: Contrast Network Flow Improving Class-Imbalanced Learning in Network Intrusion Detection

Abstract

In today's cyberspace, network traffic is more massive, complex, and multi-dimensional than ever before. In order to capture malicious network attacks, a machine learning-based network intrusion detection system (NIDS) has become the mainstream method. However, there are still high false-positive and false-negative rates, which cannot guarantee detection accuracy. On the one hand, normal behaviour dominates the Internet, and network traffic presents uneven distribution. On the other hand, the goal of machine learning algorithms is usually to obtain the highest overall accuracy without considering class-imbalanced. It is difficult for the model to learn good performance from a few attack examples. Training the model with an imbalanced data distribution often leads to severe overfitting and severely damages the model's generalization ability. To improve class-imbalanced learning in network intrusion detection, it is necessary to capture the similarities between samples in different classes and compare them with samples in other classes. Based on this, we propose ConFlow, a supervised contrastive learning method for network intrusion detection. First, we design a feature extraction encoder for bidirectional network flow, and add GELU, LayerNorm, and Skip-connection units to the MLP framework, which can enhance the representation ability of the neural network. Then, we use the dropout layer's randomness in the encoder for data augmentation, and different vector representations can be obtained by feeding the same network flow into the encoder twice. Lastly, through the weighted supervised contrastive loss and cross-entropy loss in the training phase. The ConFlow method can improve class-imbalanced learning and does not need the two stages of pre-training and fine-tuning, which can further mine maliciously attacks hidden under normal traffic. The experimental results on the ISCX-IDS2012 and CSE-CIC-IDS2017 datasets show that the ConFlow outperforms other works, and the performance improvement on few-shot learning and robustness test is more significant. The reference PyTorch code is released at https://github.com/AshinWang/ConFlow.

On the Robustness of ML-Based Network Intrusion Detection Systems: An Adversarial and Distribution Shift Perspective

“…In [56], the authors suggest a technique that contrasts network traffic in order to improve class-imbalanced learning in network intrusion detection. The dropout layer's randomness is used to produce various feature vectors, the model is inputted twice with the same flow, and supervised CL and cross-entropy are used to train the model.…”