This study investigates methods for addressing class imbalance in the CICIDS2017 network intrusion detection dataset. The dataset contains 78 traffic features with both benign and multiple attack categories. We applied three synthetic data generation approaches—SMOTE, CGAN, and Variational Autoencoder (VAE). SMOTE interpolates minority class samples, CGAN generates conditioned synthetic data via adversarial training, and VAE models the latent probability distribution to create realistic samples. We apply two machine learning algorithms to the augmented datasets—Random Forest (RF) and XGBoost (XGB), with training (80%) and testing (20%) subsets. Experimental results showed that SMOTE and CGAN, when combined with RF and XGB, achieved comparable classification performance, achieving accuracies of up to 99% and F1-scores above 0.95 across several minority attack types, while VAE lagged behind with lower predictive performance. These findings demonstrate the effectiveness of combining synthetic data generation with machine learning algorithms for multi-class intrusion detection in imbalanced datasets. However, this study is confined to traditional classifiers; future research will extend the evaluation to deep learning models and federated learning frameworks to achieve greater robustness and scalability in real-world IDS applications.

错误:搜索内容不能为空,请输入英文关键词
错误:关键词超出字数限制,请精简
高级检索

Evaluating Sampling Strategies and Generative Models for Addressing Class Imbalance in Intrusion Detection Systems

  • Vo Thanh Nhan,
  • Huynh Yen Nhi,
  • Trung Ha,
  • Dinh Thi Hong Loan,
  • Tran Khanh Dang

摘要

This study investigates methods for addressing class imbalance in the CICIDS2017 network intrusion detection dataset. The dataset contains 78 traffic features with both benign and multiple attack categories. We applied three synthetic data generation approaches—SMOTE, CGAN, and Variational Autoencoder (VAE). SMOTE interpolates minority class samples, CGAN generates conditioned synthetic data via adversarial training, and VAE models the latent probability distribution to create realistic samples. We apply two machine learning algorithms to the augmented datasets—Random Forest (RF) and XGBoost (XGB), with training (80%) and testing (20%) subsets. Experimental results showed that SMOTE and CGAN, when combined with RF and XGB, achieved comparable classification performance, achieving accuracies of up to 99% and F1-scores above 0.95 across several minority attack types, while VAE lagged behind with lower predictive performance. These findings demonstrate the effectiveness of combining synthetic data generation with machine learning algorithms for multi-class intrusion detection in imbalanced datasets. However, this study is confined to traditional classifiers; future research will extend the evaluation to deep learning models and federated learning frameworks to achieve greater robustness and scalability in real-world IDS applications.