Increasing the Performance of Machine Learning-Based IDSs on an Imbalanced and Up-to-Date Dataset

Abstract

In recent years, due to the extensive use of the Internet, the number of networked computers has been increasing in our daily lives. Weaknesses of the servers enable hackers to intrude on computers by using not only known but also new attack-types, which are more sophisticated and harder to detect. To protect the computers from them, Intrusion Detection System (IDS), which is trained with some machine learning techniques by using a pre-collected dataset, is one of the most preferred protection mechanisms. The used datasets were collected during a limited period in some specific networks and generally don't contain up-to-date data. Additionally, they are imbalanced and cannot hold sufficient data for all types of attacks. These imbalanced and outdated datasets decrease the efficiency of current IDSs, especially for rarely encountered attack types. In this paper, we propose six machine-learning-based IDSs by using K Nearest Neighbor, Random Forest, Gradient Boosting, Adaboost, Decision Tree, and Linear Discriminant Analysis algorithms. To implement a more realistic IDS, an up-to-date security dataset, CSE-CIC-IDS2018, is used instead of older and mostly worked datasets. The selected dataset is also imbalanced. Therefore, to increase the efficiency of the system depending on attack types and to decrease missed intrusions and false alarms, the imbalance ratio is reduced by using a synthetic data generation model called Synthetic Minority Oversampling TEchnique (SMOTE). Data generation is performed for minor classes, and their numbers are increased to the average data size via this technique. Experimental results demonstrated that the proposed approach considerably increases the detection rate for rarely encountered intrusions.

Network intrusion detection system: A systematic study of machine learning and deep learning approaches

“…While, a very large selection of k value may result in misclassification of the sample instance 61,62 . Karatas et al 63 compared the performance of different ML algorithms using an up‐to‐date benchmark dataset CSE‐CIC‐IDS2018. They addressed the dataset imbalance problem by reducing the imbalance ratio using Synthetic Minority Oversampling Technique (SMOTE), 64 which resulted in detection rate improvement for minority class attacks.…”

InSDN: A Novel SDN Intrusion Dataset

“…Using the complete accuracy does not yield precise comparisons [82], so we use the most important performance indicators to evaluate our proposed model, such as precision, recall, VOLUME 8, 2020 precision and F-score. These metrics are commonly used in intrusion detection systems and are defined as follows:…”

The Effective Methods for Intrusion Detection With Limited Network Attack Data: Multi-Task Learning and Oversampling

“…At present, many traditional machine learning methods and deep learning methods have been applied to AIDSs. For instance, in 2020, six different machine learning models (Decision Tree, Random Forest, K Nearest Neighbor, Adaboost, Gradient Boosting, and Linear Discriminant Analysis) were implemented using the CICIDS2018 dataset [10], and Zhou et al [5] proposed an XSS attack detection method based on an ensemble learning approach learnt with domain knowledge and threat intelligence. In order to obtain high accuracy, high packet detection rate, and low false positive rate of AID-S, Iwendi et al [11] proposed a CFS + Ensemble Classifiers.…”

“…Among them, the main idea of data-level method is to oversample the minority class. This method can be easily combined with other algorithms and widely used in many applications [10], [29].…”