I-SiamIDS: an improved Siam-IDS for handling class imbalance in network-based intrusion detection systems

Abstract

Network-based Intrusion Detection Systems (NIDSs) identify malicious activities by analyzing network traffic. NIDSs are trained with the samples of benign and intrusive network traffic. Training samples belong to either majority or minority classes depending upon the number of available instances. Majority classes consist of abundant samples for the normal traffic as well as for recurrent intrusions. Whereas, minority classes include fewer samples for unknown events or infrequent intrusions. NIDSs trained on such imbalanced data tend to give biased predictions against minority attack classes, causing undetected or misclassified intrusions. Past research works handled this class imbalance problem using data-level approaches that either increase minority class samples or decrease majority class samples in the training data set. Although these data-level balancing approaches indirectly improve the performance of NIDSs, they do not address the underlying issue in NIDSs i.e. they are unable to identify attacks having limited training data only. This paper proposes an algorithm-level approach called Improved Siam-IDS (I-SiamIDS), which is a two-layer ensemble for handling class imbalance problem. I-SiamIDS identifies both majority and minority classes at the algorithm-level without using any data-level balancing techniques. The first layer of I-SiamIDS uses an ensemble of binary eXtreme Gradient Boosting (b-XGBoost), Siamese Neural Network (Siamese-NN) and Deep Neural Network (DNN) for hierarchical filtration of input samples to identify attacks. These attacks are then sent to the second layer of I-SiamIDS for classification into different attack classes using multi-class eXtreme Gradient Boosting classifier (m-XGBoost). As compared to its counterparts, I-SiamIDS showed significant improvement in terms of Accuracy, Recall, Precision, F1score and values of Area Under the Curve (AUC) for both NSL-KDD and CIDDS-001 datasets. To further strengthen the results, computational cost analysis was also performed to study the acceptability of the proposed I-SiamIDS.

[Retracted] Malicious Intrusion Data Mining Algorithm of Wireless Personal Communication Network Supported by Legal Big Data

“…All communication data are classified according to the membership degree between the above wireless personal communication data. Because wireless personal communication data mainly includes two kinds of data, one is normal data and the other is malicious intrusion data [10], it is necessary to separate malicious intrusion data from all data. That is to become the focus of this study data.…”

Ensemble learning for intrusion detection systems: A systematic mapping study and cross-benchmark evaluation

“…Abirami et al [124] combined RF, SVM, and NB using a stacking algorithm, where LR was used as a meta-classifier for IDS. Bedi et al [93] proposed an algorithm-level approach called I-SiamIDS, which is a two-layer ensemble for handling class imbalance problems. Cheng et al [128] utilized a semi-supervised hierarchical stacking model for anomaly detection in IoT communication.…”

HCRNNIDS: Hybrid Convolutional Recurrent Neural Network-Based Network Intrusion Detection System

“…The classification problem becomes more complicated as the data dimensionality increases due to unbounded data values and unbalanced classes. Bedi et al [59] utilized several ML approaches to deal with the class imbalance issue. Thabtah et al [60] also evaluated various approaches to the class imbalance problem.…”