Improving the Accuracy of Network Intrusion Detection with Causal Machine Learning

Abstract

In recent years, machine learning (ML) algorithms have been approved effective in the intrusion detection. However, as the ML algorithms are mainly applied to evaluate the anomaly of the network, the detection accuracy for cyberattacks with multiple types cannot be fully guaranteed. The existing algorithms for network intrusion detection based on ML or feature selection are on the basis of spurious correlation between features and cyberattacks, causing several wrong classifications. In order to tackle the abovementioned problems, this research aimed to establish a novel network intrusion detection system (NIDS) based on causal ML. The proposed system started with the identification of noisy features by causal intervention, while only the features that had a causality with cyberattacks were preserved. Then, the ML algorithm was used to make a preliminary classification to select the most relevant types of cyberattacks. As a result, the unique labeled cyberattack could be detected by the counterfactual detection algorithm. In addition to a relatively stable accuracy, the complexity of cyberattack detection could also be effectively reduced, with a maximum reduction to 94% on the size of training features. Moreover, in case of the availability of several types of cyberattacks, the detection accuracy was significantly improved compared with the previous ML algorithms.

Towards Intelligent Attack Detection Using DNA Computing

“…However, with the explosive growth of network traffic, abnormal network traffic is increasingly characterized by complexity, concealment, and diversity, causing the failure of traditional attack detection systems [ 6 ]. To cope with this trend, researchers have developed many attack detection methods based on rough set theory, machine learning, and deep learning [ 7 ]. For example, traditional detection methods based on rough set theory [ 8 ] have the advantage of being able to detect network attacks, even with incomplete data.…”

“…This noise and redundant information is closely related to useful information, which not only increases the computational complexity and time consumption of attack detection but also leads to the deletion of useful information while retaining part of the noise and redundant information during feature dimension reduction. This creates serious challenges for attack detection technology [ 7 ]. Due to the difficulty in collecting samples of some attack types in the existing detection dataset, the actual number of cases is small, and data imbalance is prevalent [ 12 ].…”

Optimizing Intrusion Detection Systems in Three Phases on the CSE-CIC-IDS-2018 Dataset

“…This is accomplished by removing the feature's mean from each value and then dividing by the standard deviation. Mathematical equation for this strategy is given as (2), where X is an original value and X is the normalized value [36]:…”