Handling Labeled Data Insufficiency: Semi-supervised Learning with Self-Training Mixup Decision Tree for Classification of Network Attacking Traffic

Abstract

Motivated by the fast advancements in artificial intelligence (AI) technologies, recent research has moved towards using machine learning and deep learning to detect and classify security attacks in computer networks. However, most prior works adopt supervised learning methods, and the performance heavily depends on the amount of labeled data used to train the detection models. Network attack detection and classification is not an exception due to the lack of labeled data, especially the attacking traffic, which is much less than the regular (legitimate) traffic. Yet, labeling network traffic is also challenging and requires specific domain expertise. This paper proposes an efficient semi-supervised learning method for the classification of network attacking traffic, known as Self-Training Mixup Decision Tree (STM-DT). STM-DT first trains a decision tree on a small amount of labeled data and then uses the obtained model to predict labels of unlabeled samples. Some noisy labels will be removed by consistency. The predicted samples will then be mixed with labeled samples using <monospace>mixup</monospace> to train a new decision tree, which is the final desired classifier. We evaluate STM-DT using four network traffic datasets. Experimental results demonstrate that the proposed STM-DT method achieves higher macro F1 scores over different minority labeled data percentages.