Using the SGE-CGAM Method to Address Class Imbalance Issues in Network Intrusion Detection

Network Intrusion Detection Systems (NIDS) play a crucial role in safeguarding network security and data integrity. Nevertheless, the challenge of class imbalance within intrusion detection datasets hampers the classifier’s performance on minority classes. To simultaneously improve detection precision while maintaining efficiency, we introduce an innovative approach for addressing class imbalance in extensive datasets, denoted as SGE (SMOTE-Gaussian Mixture Model-Edited Nearest Neighbors). This approach amalgamates oversampling techniques, such as SMOTE, with the Gaussian Mixture Model (GMM), and undersampling techniques, including Edited Nearest Neighbors (ENN). Additionally, we have enhanced a deep learning model architecture, denoted as the CNN-biGRU-ATT Model (Convolutional Neural Network - bidirectional Gated Recurrent Unit - Attention mechanism), which integrates Convolutional Neural Networks (CNN), bidirectional Gated Recurrent Units (biGRU), and attention mechanisms (ATT). We ultimately devised a hybrid network intrusion detection model, SGE-CGAM, which combines class imbalance handling with a blended deep learning model. We validated the superiority of this model using the CICIDS2017 dataset. The results obtained from the experiments demonstrate that for binary-class and multi-class tasks on the CICIDS2017 dataset, SGE-CGAM achieved Precision rates of 99.98% and 99.76%, respectively, underscoring SGE-CGAM as an effective intrusion detection solution.