Imbalanced Network Research Articles

DBSCAN SMOTE LSTM: Effective Strategies for Distributed Denial of Service Detection in Imbalanced Network Environments

In detecting Distributed Denial of Service (DDoS), deep learning faces challenges and difficulties such as high computational demands, long training times, and complex model interpretation. This research focuses on overcoming these challenges by proposing an effective strategy for detecting DDoS attacks in imbalanced network environments. This research employed DBSCAN and SMOTE to increase the class distribution of the dataset by allowing models using LSTM to learn time anomalies effectively when DDoS attacks occur. The experiments carried out revealed significant improvement in the performance of the LSTM model when integrated with DBSCAN and SMOTE. These include validation loss results of 0.048 for LSTM DBSCAN and SMOTE and 0.1943 for LSTM without DBSCAN and SMOTE, with accuracy of 99.50 and 97.50. Apart from that, there was an increase in the F1 score from 93.4% to 98.3%. This research proved that DBSCAN and SMOTE can be used as an effective strategy to improve model performance in detecting DDoS attacks on heterogeneous networks, as well as increasing model robustness and reliability.

An Adaptive Enhancement Method of Malicious Traffic Samples Based on DCGAN-ResNet System

A malicious traffic sample adaptive enhancement device based on Deep Convolutional Generative Adversarial Network (DCGAN) is designed to address the issue of imbalanced network traffic data distribution, aiming to enhance the accuracy and efficiency of anomaly detection. By leveraging generative adversarial network technology, this device can generate samples similar to real malicious traffic to balance the training dataset. It utilizes the generator and discriminator of the Deep Convolutional Generative Adversarial Network (DCGAN), combined with the residual network (ResNet) in the CNN model, to enhance the quality of generated samples. The device can switch states to adapt to various network environments and has been experimentally validated for its effectiveness and feasibility.Moreover, employing an adaptive device, the samples of malicious traffic are adjusted. Experimental analysis demonstrates that the device significantly enhances the accuracy of anomaly traffic detection, improves robustness, and provides robust support for network security protection.

Three layer hybrid learning to improve intrusion detection system performance

In imbalanced network traffic, malicious cyberattacks can be hidden in a large amount of normal traffic, making it difficult for intrusion detection systems (IDS) to detect them. Therefore, anomaly-based IDS with machine learning is the solution. However, a single machine learning cannot accurately detect all types of attacks. Therefore, a hybrid model that combines long short-term memory (LSTM) and random forest (RF) in three layers is proposed. Building the hybrid model starts with Nearmiss-2 class balancing, which reduces normal samples without increasing minority samples. Then, feature selection is performed using chi-square and RF. Next, hyperparameter tuning is performed to obtain the optimal model. In the first and second layers, LSTM and RF are used for binary classification to detect normal data and attack data. While the third layer model uses RF for multiclass classification. The hybrid model verified using the CSE-CIC-IDS2018 dataset, showed better performance compared to the single algorithm. For multiclass classification, the hybrid model achieved 99.76% accuracy, 99.76% precision, 99.76% recall, and 99.75% F1-score.

An improved focal loss for imbalanced network traffic classification

With the continued progress of the Internet, network security has become an increasingly significant issue that requires constant attention and research. Network traffic classification is a key technology used to detect and prevent malicious network activity, and it has accordingly received increasing attention and research. However, datasets related to malicious network traffic classification often have imbalanced characteristics. In conventional traffic classification problems with multiple categories, the sample size characteristics of small categories are often overlooked. To address this issue, the focal loss function was proposed, which focuses on small samples by modulating the trade-off between the positive and negative samples through two hyperparameters and . This article uses convolutional neural networks (CNN) to tackle traffic classification problem and explore the optimal values of parameters in this application scenario. Additionally, this work proposed a novel weight allocation formula to replace , which allowed small class traffic to obtain higher accuracy.

Empowering Network Security: BERT Transformer Learning Approach and MLP for Intrusion Detection in Imbalanced Network Traffic

Empowering Network Security: BERT Transformer Learning Approach and MLP for Intrusion Detection in Imbalanced Network Traffic

An FPA-Optimized XGBoost Stacking for Multi-Class Imbalanced Network Attack Detection

An FPA-Optimized XGBoost Stacking for Multi-Class Imbalanced Network Attack Detection

Evaluating Tree-based Ensemble Strategies for Imbalanced Network Attack Classification

Evaluating Tree-based Ensemble Strategies for Imbalanced Network Attack Classification

Enhancing the Network Anomaly Detection using CNN-Bidirectional LSTM Hybrid Model and Sampling Strategies for Imbalanced Network Traffic Data

Enhancing the Network Anomaly Detection using CNN-Bidirectional LSTM Hybrid Model and Sampling Strategies for Imbalanced Network Traffic Data

Botnet detection in the internet-of-things networks using convolutional neural network with pelican optimization algorithm

Hackers nowadays employ botnets to undertake cyberattacks towards the Internet of Things (IoT) by illegally exploiting the scattered network’s resources of computing devices. Several Machine Learning (ML) and Deep Learning (DL) methods for detecting botnet (BN) assaults in IoT networks have recently been proposed. However, in the training set, severely imbalanced network traffic data degrades the classification performances of state-of-the-art ML as well as DL algorithm, particularly in classes with very few samples. The Convolutional Neural Network -Pelican Optimization System (CNN-POA) is a DL relied botnet attack detection algorithm developed in this research. Meanwhile, typical evaluation markers are used to compare the overall performance of the proposed CNN-POA and additional frequently employed algorithms. The simulation results suggest that the CNN-POA method is effective and dependable for detecting IoT network intrusion attacks. Experiments revealed that the suggested CNN-POA approach outperformed a number of current metaheuristic algorithms, with an accuracy of 99.5%.

Which standard classification algorithm has more stable performance for imbalanced network traffic data?

Which standard classification algorithm has more stable performance for imbalanced network traffic data?

Anomaly Detection for Network Security

Today, network security is crucial due to the rapid development of network and internet technologies, as well as the continuous growth in network threats. Detecting network anomalies is one of the approaches that may be used to safeguard a network's security. Recent research has focused extensively on techniques for identifying abnormalities. Using the Autoencoder model together with data pre-processing techniques such as data resampling and feature selection, this research describes a novel approach for identifying network abnormalities. It has been shown that the suggested strategy is applicable to network intrusion data. A comparison of the reconstruction error to a threshold value determines whether the traffic data is normal or anomalous. CICIDS2017 dataset is selected to evaluate the implementation of the proposed Autoencoder model based on real-world, large-scale, current network traffic data The proposed model with data pre-processed achieved F1-Score of 76% which outperformed the baseline model without feature selection and data resampling in data pre-processing stages. This research project investigated the effect of data pre-processing techniques on the performance of the proposed Autoencoder. At the end of this research project, it is demonstrated that the proposed methodologies are applicable towards imbalanced network intrusion data.

Survey of Intrusion Detection of Imbalanced Network based on Machine Learning Algorithm

Survey of Intrusion Detection of Imbalanced Network based on Machine Learning Algorithm

Implementation of Efficient Intrusion Detection of Imbalanced Network Traffic using Deep Learning

A crucial component of network security is intrusion detection, but this task can be difficult when dealing with statistics on the distribution of network traffic, where benign cases exceed malicious ones by a large margin. The goal of this project is to create a powerful intrusion detection system using a recurrent neural network (RNN) to address this problem. RNNs are excellent at identifying temporal dependencies in sequential data, which makes them useful for examining network traffic patterns. The suggested methodology calls for preprocessing the data, balancing the dataset, feature extraction, choosing an RNN model, training, assessing, adjusting, and monitoring in real time. The network traffic data is cleaned and formatted during the preprocessing stage, and balancing algorithms make sure the RNN is trained on a representative dataset. It then extracts pertinent aspects, including behavioral patterns and packet header data. Effective intrusion detection requires the use of an appropriate RNN architecture, such as LSTM or GRU. The model is subsequently trained, assessed using a range of criteria, and refined through iterations. The optimized RNN model is then implemented for real-time intrusion detection, monitoring network traffic continuously and producing alerts for probable intrusions. This research seeks to improve the precision and efficacy of network security systems, maintaining the integrity of crucial information in the linked world of today, by utilizing RNNs for intrusion detection in imbalanced network trafficking. Keywords IDS, Imbalanced Network Traffic, Deep Learning, Recurrent Neural Network.

An Effective Network Intrusion Detection Model for Coarse-to-Fine Attack Classification of Imbalanced Network Traffic

An Effective Network Intrusion Detection Model for Coarse-to-Fine Attack Classification of Imbalanced Network Traffic

Resampling Imbalanced Network Intrusion Datasets to Identify Rare Attacks

This study, focusing on identifying rare attacks in imbalanced network intrusion datasets, explored the effect of using different ratios of oversampled to undersampled data for binary classification. Two designs were compared: random undersampling before splitting the training and testing data and random undersampling after splitting the training and testing data. This study also examines how oversampling/undersampling ratios affect random forest classification rates in datasets with minority dataor rare attacks. The results suggest that random undersampling before splitting gives better classification rates; however, random undersampling after oversampling with BSMOTE allows for the use of lower ratios of oversampled data.

A novel cyber intrusion detection model based on improved hybrid sampling

The class imbalance of samples of network traffic will cause the poor classification performance of intrusion detection models based on machine learning. To solve this problem, this paper researches sampling algorithm and deep learning for intrusion detection in imbalanced network traffic. This paper proposes a deep recurrent neural network (delayed long short-term memory (DLSTM)) intrusion detection model based on the balanced samples. First, an improved hybrid sampling (IHS) method based on chaotic particle swarm optimization (CPSO) algorithm is proposed as the sampling algorithm to balance the imbalanced samples. Next, a DLSTM with long short-term memory (LSTM) function is proposed to realize high-precision classification of intrusion behaviours. Finally, the method is validated on the standard network traffic dataset. The experimental results show that the DLSTM intrusion detection model based on the IHS method outperforms other comparative models at accuracy. The model is available to the computer network information security defence system.

IDS-INT: Intrusion detection system using transformer-based transfer learning for imbalanced network traffic

A network intrusion detection system is critical for cyber security against illegitimate attacks. In terms of feature perspectives, network traffic may include a variety of elements such as attack reference, attack type, a sub-category of attack, host information, malicious scripts, etc. In terms of network perspectives, network traffic may contain an imbalanced number of harmful attacks when compared to normal traffic. It is challenging to identify a specific attack due to complex features and data imbalance issues. To address these issues, this paper proposes an Intrusion Detection System using transformer-based transfer learning for Imbalanced Network Traffic (IDS-INT). IDS-INT uses transformer-based transfer learning to learn feature interactions in both network feature representation and imbalanced data. First, detailed information about each type of attack is gathered from network interaction descriptions, which include network nodes, attack type, reference, host information, etc. Second, the transformer-based transfer learning approach is developed to learn detailed feature representation using their semantic anchors. Third, the Synthetic Minority Oversampling Technique (SMOTE) is implemented to balance abnormal traffic and detect minority attacks. Fourth, the Convolution Neural Network (CNN) model is designed to extract deep features from the balanced network traffic. Finally, the hybrid approach of the CNN-Long Short-Term Memory (CNN-LSTM) model is developed to detect different types of attacks from the deep features. Detailed experiments are conducted to test the proposed approach using three standard datasets, i.e., UNSW-NB15, CIC-IDS2017, and NSL-KDD. An explainable AI approach is implemented to interpret the proposed method and develop a trustable model.

Deep Regularization Mechanism for Combating Class Imbalance Problem in Intrusion Detection System for Defending DDoS Attack in SDN

Integration of deep learning into Intrusion Detection Systems (IDS) for Software Defined Networking (SDN) is an emerging field of research. Most of the datasets used to build IDS are highly imbalanced, especially in the case of DDoS attacks, which account for a larger percentage of malicious samples than normal traffic. As a result of a class imbalance, the classification result is distorted since deep learning is limited in its ability to generalize and is misled into favoring the majority class. This study aims to confront the problem of class imbalance by introducing a new deep regularization mechanism that allows the learning model to unlearn biased information. Unlike the existing system, the proposed mechanism integrates two multi-layer neural networks to extract shared information and biased distribution. The first learning model generalizes the data distribution to classify network traffic as normal or attacks class. On the other hand, the second model is integrated with the embedding layers feature of the first model, which learns the bias distribution and then it regressively instructs the first network not to learn this biased information. The proposed regularization scheme is evaluated on the most recent and highly imbalanced network dataset CIC-DDoS2019. The proposed scheme is compared with different supervised learning classifiers executed on the same dataset in the experiment, balanced with the smote technique. The proposed model outperforms other learning techniques and reached an overall precision, recall, and F1-score of 96.71, 97.14, and 96.92%, respectively.

NETWORK TRAFFIC DETECTION THROUGH MACHINE LEARNING

In imbalanced network traffic, malicious cyber-attacks can often hide in large amounts of normal data. It exhibits a high degree of stealth and obfuscation in cyberspace, making it difficult for Network Intrusion Detection System (NIDS) to ensure the accuracy and timeliness of detection. This paper researches machine learning and deep learning for intrusion detection in imbalanced network traffic. It proposes a novel Difficult Set Sampling Technique (DSSTE) algorithm to tackle the class imbalance problem. To verify the proposed method, we conduct experiments on the classic intrusion dataset NSL-KDD and the newer and comprehensive intrusion dataset CSE-CIC-IDS2018. We use classical classification models: random forest(RF), Support Vector Machine(SVM), XGBoost, MLP AlexNet, Mini-VGGNet.

MEMBER: A multi-task learning model with hybrid deep features for network intrusion detection

With the continuous occurrence of cybersecurity incidents, network intrusion detection has become one of the most critical issues in cyber ecosystems. Although previous machine learning-based approaches have made significant progress, their generalization ability is limited due to the following critical challenges. First, intrusion detection is severely affected by the class imbalance problem in many network scenarios, with some attack types representing only a very small subset of the entire training set. Second, cyberattacks are becoming increasingly sophisticated, and hence, it is becoming more challenging for existing methods to extract robust representations. Third, most existing methods generally leverage only a particular aspect of the network traffic features and treat model training as a single-task learning problem, thus ignoring the discriminative ability of different feature types and the performance enhancement of integrating multiple machine learning tasks. In this paper, we propose a Multi-task lEarning Model with hyBrid dEep featuRes (MEMBER) to address the aforementioned challenges. Based on a Convolutional Neural Network (CNN) with embedded spatial and channel attention mechanisms, MEMBER innovatively introduces two auxiliary tasks (i.e., an auto-encoder (AE) enhanced with a memory module and a distance-based prototype network) to boost the model generalization ability and alleviate the performance degradation suffered in imbalanced network environments. Extensive experiments on several benchmark datasets demonstrate the superiority and robustness of our proposed MEMBER in terms of both F1 score and stability.