Skip to main content
SpringerLink
Log in

Dealing with Imbalanced Data in Multi-class Network Intrusion Detection Systems Using XGBoost

  • Conference paper
  • First Online:
Machine Learning and Principles and Practice of Knowledge Discovery in Databases (ECML PKDD 2021)

Part of the book series: Communications in Computer and Information Science ((CCIS,volume 1525))

Abstract

Network intrusion detection is a crucial cyber-security problem, where machine learning is recognised as a relevant approach to detect signs of malicious activity in the network traffic. However, intrusion detection patterns learned with imbalanced network traffic data often fail in recognizing rare attacks. One way to address this issue is to use oversampling before learning, in order to adjust the ratio between the different classes and make the traffic data more balanced. This paper investigates the effect of oversampling coupled to feature selection, in order to understand how the feature relevance may change due to the creation of artificial rare samples. We perform this study using XGBoost for the network traffic classification. The experiments are performed with two benchmark multi-class network intrusion detection problems.

This is a preview of subscription content, log in via an institution to check access.

Access this chapter

Log in via an institution
Chapter
USD 29.95
Price excludes VAT (USA)
  • Available as PDF
  • Read on any device
  • Instant download
  • Own it forever
eBook
USD 79.99
Price excludes VAT (USA)
  • Available as EPUB and PDF
  • Read on any device
  • Instant download
  • Own it forever
Softcover Book
USD 99.99
Price excludes VAT (USA)
  • Compact, lightweight edition
  • Dispatched in 3 to 5 business days
  • Free shipping worldwide - see info

Tax calculation will be finalised at checkout

Purchases are for personal use only

Institutional subscriptions

Notes

  1. 1.

    https://www.unb.ca/cic/datasets/nsl.html.

  2. 2.

    https://github.com/ModelOriented/DALEX.

References

  1. Ahmad, Z., Shahid Khan, A., Wai Shiang, C., Abdullah, J., Ahmad, F.: Network intrusion detection system: a systematic study of machine learning and deep learning approaches. Trans. Emerg. Telecommun. Technol. 32(1), e4150 (2021). https://doi.org/10.1002/ett.4150

    Article  Google Scholar 

  2. Alazzam, H., Sharieh, A., Sabri, K.E.: A feature selection algorithm for intrusion detection system based on pigeon inspired optimizer. Expert Syst. Appl. 148, 113249 (2020). https://doi.org/10.1016/j.eswa.2020.113249

    Article  Google Scholar 

  3. Alin, F., Chemchem, A., Nolot, F., Flauzac, O., Krajecki, M.: Towards a hierarchical deep learning approach for intrusion detection. In: Boumerdassi, S., Renault, É., Mühlethaler, P. (eds.) MLN 2019. LNCS, vol. 12081, pp. 15–27. Springer, Cham (2020). https://doi.org/10.1007/978-3-030-45778-5_2

    Chapter  Google Scholar 

  4. Andresini, G., Appice, A., Di Mauro, N., Loglisci, C., Malerba, D.: Exploiting the auto-encoder residual error for intrusion detection. In: 2019 IEEE European Symposium on Security and Privacy Workshops (EuroS PW), pp. 281–290. IEEE (2019)

    Google Scholar 

  5. Andresini, G., Appice, A., Malerba, D.: Autoencoder-based deep metric learning for network intrusion detection. Inf. Sci. 569, 706–727 (2021). https://doi.org/10.1016/j.ins.2021.05.016

    Article  MathSciNet  Google Scholar 

  6. Andresini, G., Appice, A., Malerba, D.: Nearest cluster-based intrusion detection through convolutional neural networks. Knowl.-Based Syst. 216, 106798 (2021). https://doi.org/10.1016/j.knosys.2021.106798

    Article  Google Scholar 

  7. Andresini, G., Appice, A., Mauro, N.D., Loglisci, C., Malerba, D.: Multi-channel deep feature learning for intrusion detection. IEEE Access 8, 53346–53359 (2020)

    Article  Google Scholar 

  8. Andresini, G., Appice, A., Rose, L.D., Malerba, D.: Gan augmentation to deal with imbalance in imaging-based intrusion detection. Futur. Gener. Comput. Syst. 123, 108–127 (2021)

    Article  Google Scholar 

  9. Bagui, S., Li, K.: Resampling imbalanced data for network intrusion detection datasets. J. Big Data 8(1), 1–41 (2021). https://doi.org/10.1186/s40537-020-00390-x

    Article  Google Scholar 

  10. Baniecki, H., Kretowicz, W., Piatyszek, P., Wisniewski, J., Biecek, P.: dalex: Responsible Machine Learning with Interactive Explainability and Fairness in Python. arXiv:2012.14406 (2020). https://arxiv.org/abs/2012.14406

  11. Bansal, A., Kaur, S.: Extreme gradient boosting based tuning for classification in intrusion detection systems. In: Singh, M., Gupta, P.K., Tyagi, V., Flusser, J., Ören, T. (eds.) ICACDS 2018. CCIS, vol. 905, pp. 372–380. Springer, Singapore (2018). https://doi.org/10.1007/978-981-13-1810-8_37

    Chapter  Google Scholar 

  12. Bedi, P., Gupta, N., Jindal, V.: I-SiamIDS: an improved Siam-IDS for handling class imbalance in network-based intrusion detection systems. Appl. Intell. 51, 1133–1151 (2021)

    Article  Google Scholar 

  13. Bhati, B.S., Chugh, G., Al-Turjman, F., Bhati, N.S.: An improved ensemble based intrusion detection technique using XGBoost. Trans. Emerg. Telecommun. Technol. 1–15 (2020). https://doi.org/10.1002/ett.4076

  14. Chawla, N., Bowyer, K., Hall, L., Kegelmeyer, W.: Smote: synthetic minority over-sampling technique. J. Artif. Intell. Res. (JAIR) 16, 321–357 (2002)

    Article  Google Scholar 

  15. Chen, T., Guestrin, C.: Xgboost: a scalable tree boosting system. In: Proceedings of the 22nd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, KDD 2016, pp. 785–794. Association for Computing Machinery, New York (2016). https://doi.org/10.1145/2939672.2939785

  16. da Costa, K.A., Papa, J.P., Lisboa, C.O., Munoz, R., de Albuquerque, V.H.C.: Internet of things: a survey on machine learning-based intrusion detection approaches. Comput. Netw. 151, 147–157 (2019). https://doi.org/10.1016/j.comnet.2019.01.023

    Article  Google Scholar 

  17. Devan, P., Khare, N.: An efficient XGBoost–DNN-based classification model for network intrusion detection system. Neural Comput. Appl. 32(16), 12499–12514 (2020). https://doi.org/10.1007/s00521-020-04708-x

    Article  Google Scholar 

  18. Fisher, A., Rudin, C., Dominici, F.: All models are wrong, but many are useful: learning a variable’s importance by studying an entire class of prediction models simultaneously. J. Mach. Learn. Res. 20(177), 1–81 (2019)

    MathSciNet  MATH  Google Scholar 

  19. Gao, X., Shan, C., Hu, C., Niu, Z., Liu, Z.: An adaptive ensemble machine learning model for intrusion detection. IEEE Access 7, 82512–82521 (2019). https://doi.org/10.1109/ACCESS.2019.2923640

    Article  Google Scholar 

  20. Inzimam, M., Yongle, C., Zhang, Z.: An efficient approach towards assessment of zero-day attacks. Int. J. Comput. Appl. 975, 8887 (2019)

    Google Scholar 

  21. Jiang, H., He, Z., Ye, G., Zhang, H.: Network intrusion detection based on PSO-Xgboost model. IEEE Access 8, 58392–58401 (2020). https://doi.org/10.1109/ACCESS.2020.2982418

    Article  Google Scholar 

  22. Lorena, A.C., de Leon Ferreira de Carvalho, A.C.P., Gama, J.: A review on the combination of binary classifiers in multiclass problems. Artif. Intell. Rev. 30(1–4), 19–37 (2008). https://doi.org/10.1007/s10462-009-9114-9

    Article  Google Scholar 

  23. Ma, X., Shi, W.: AESMOTE: adversarial reinforcement learning with SMOTE for anomaly detection. IEEE Trans. Netw. Sci. Eng. 8(2), 943–956 (2021). https://doi.org/10.1109/TNSE.2020.3004312

  24. Pan, L., Xie, X.: Network intrusion detection model based on PCA + ADASYN and XGBoost. In: 3rd International Conference on E-Business, Information Management and Computer Science, EBIMCS 2020, pp. 44–48. Association for Computing Machinery (2020)

    Google Scholar 

  25. Rajagopal, S., Kundapur, P.P., Hareesha, K.S.: Towards effective network intrusion detection: from concept to creation on azure cloud. IEEE Access 9, 19723–19742 (2021). https://doi.org/10.1109/ACCESS.2021.3054688

    Article  Google Scholar 

  26. Sapre, S., Islam, K., Ahmadi, P.: A comprehensive data sampling analysis applied to the classification of rare IoT network intrusion types. In: IEEE 18th Annual Consumer Communications Networking Conference, CCNC 2021, pp. 1–2 (2021). https://doi.org/10.1109/CCNC49032.2021.9369617

  27. Sharafaldin, I., Habibi Lashkari, A., Ghorbani, A.: Toward generating a new intrusion detection dataset and intrusion traffic characterization, pp. 108–116 (2018). https://doi.org/10.5220/0006639801080116

  28. Tan, X., et al.: Wireless sensor networks intrusion detection based on smote and the random forest algorithm. Sensors 19(1), 203 (2019). https://doi.org/10.3390/s19010203

    Article  Google Scholar 

  29. Tavallaee, M., Bagheri, E., Lu, W., Ghorbani, A.A.: A detailed analysis of the KDD CUP 99 data set. In: CISDA, pp. 1–6 (2009)

    Google Scholar 

  30. Velan, P., Medková, J., Jirsík, T., Čeleda, P.: Network traffic characterisation using flow-based statistics. In: NOMS 2016–2016 IEEE/IFIP Network Operations and Management Symposium, pp. 907–912 (2016)

    Google Scholar 

  31. Vergara, J.R., Estévez, P.A.: A review of feature selection methods based on mutual information. Neural Comput. Appl. 24(1), 175–186 (2013). https://doi.org/10.1007/s00521-013-1368-0

    Article  Google Scholar 

  32. Vinayakumar, R., Alazab, M., Soman, K.P., Poornachandran, P., Al-Nemrat, A., Venkatraman, S.: Deep learning approach for intelligent intrusion detection system. IEEE Access 7, 41525–41550 (2019)

    Article  Google Scholar 

  33. Yu, L., Liu, H.: Feature selection for high-dimensional data: A fast correlation-based filter solution. In: Proceedings, Twentieth International Conference on Machine Learning, vol. 2, pp. 856–863 (2003)

    Google Scholar 

  34. Zuech, R., Khoshgoftaar, T.: A survey on feature selection for intrusion detection. In: ISSAT International Conference on Reliability and Quality in Design, pp. 150–155 (2015)

    Google Scholar 

Download references

Acknowledgments

The research of Malik AL-Essa is funded by PON RI 2014-2020 - Machine Learning per l’Investigazione di Cyber-minacce e la Cyber-difesa - CUP H98B20000970007. We acknowledge the support of the project “Modelli e tecniche di data science per la analisi di dati strutturati” funded by the University of Bari “Aldo Moro”.

Author information

Authors and Affiliations

  1. Dipartimento di Informatica, Università degli Studi di Bari Aldo Moro, via Orabona, 4, 70126, Bari, Italy

    Malik AL-Essa & Annalisa Appice

  2. Consorzio Interuniversitario Nazionale per lInformatica - CINI, Bari, Italy

    Annalisa Appice

Authors
  1. Malik AL-Essa
    View author publications

    You can also search for this author in PubMed Google Scholar

  2. Annalisa Appice
    View author publications

    You can also search for this author in PubMed Google Scholar

Corresponding author

Correspondence to Malik AL-Essa .

Editor information

Editors and Affiliations

  1. IKIM, Ruhr-University Bochum, Bochum, Germany

    Michael Kamp

  2. University of Sydney, Sydney, NSW, Australia

    Irena Koprinska

  3. University of Namur, Namur, Belgium

    Adrien Bibal

  4. University of Rennes 1, Rennes, France

    Tassadit Bouadi

  5. University of Namur, Namur, Belgium

    Benoît Frénay

  6. Inria, Rennes, France

    Luis Galárraga

  7. University of Antwerp, Antwerp, Belgium

    José Oramas

  8. Ruhr University Bochum, Bochum, Germany

    Linara Adilova

  9. Royal Holloway University of London, Egham, UK

    Yamuna Krishnamurthy

  10. Ghent University, Ghent, Belgium

    Bo Kang

  11. Université Jean Monnet, Saint-Etienne cedex 2, France

    Christine Largeron

  12. Ghent University, Gent, Belgium

    Jefrey Lijffijt

  13. Telecom Paris, Paris, France

    Tiphaine Viard

  14. University of Bonn, Bonn, Germany

    Pascal Welke

  15. Norwegian Univesity of Science and Technology, Trondheim, Norway

    Massimiliano Ruocco

  16. BI Norwegian Business School, Oslo, Norway

    Erlend Aune

  17. University of Pisa, Pisa, Italy

    Claudio Gallicchio

  18. University of Duisburg-Essen, Essen, Germany

    Gregor Schiele

  19. Graz University of Technology, Graz, Austria

    Franz Pernkopf

  20. Xilinx Research, Dublin, Ireland

    Michaela Blott

  21. Heidelberg University, Heidelberg, Germany

    Holger Fröning

  22. Heidelberg University, Heidelberg, Germany

    Günther Schindler

  23. University of Pisa, Pisa, Italy

    Riccardo Guidotti

  24. University of Pisa, Pisa, Italy

    Anna Monreale

  25. ISTI-CNR, Pisa, Italy

    Salvatore Rinzivillo

  26. Warsaw University of Technology, Warsaw, Poland

    Przemyslaw Biecek

  27. Freie Universität Berlin, Berlin, Germany

    Eirini Ntoutsi

  28. Eindhoven University of Technology, Eindhoven, The Netherlands

    Mykola Pechenizkiy

  29. Leibniz University Hannover, Hannover, Germany

    Bodo Rosenhahn

  30. University of Sussex, Brighton, UK

    Christopher Buckley

  31. University of Chieti-Pescara, Chieti, Italy

    Daniela Cialfi

  32. Radboud University Nijmegen, Nijmegen, The Netherlands

    Pablo Lanillos

  33. McGill University, Montreal, Canada

    Maxwell Ramstead

  34. Ghent University, Ghent, Belgium

    Tim Verbelen

  35. University of Lisbon, Lisboa, Portugal

    Pedro M. Ferreira

  36. University of Bari Aldo Moro, Bari, Italy

    Giuseppina Andresini

  37. Universita di Bari Aldo Moro, Bari, Italy

    Donato Malerba

  38. University of Lisbon, Lisbon, Portugal

    Ibéria Medeiros

  39. Shenzhen University, Shenzhen, China

    Philippe Fournier-Viger

  40. Harbin Institute of Technology, Harbin, China

    M. Saqib Nawaz

  41. University of Córdoba, Córdoba, Spain

    Sebastian Ventura

  42. Peking University, Beijing, China

    Meng Sun

  43. Noah's Ark Lab, Huawei, Beijing, China

    Min Zhou

  44. UniCredit, Milan, Italy

    Valerio Bitetta

  45. UniCredit, Rome, Italy

    Ilaria Bordino

  46. UniCredit, Milan, Italy

    Andrea Ferretti

  47. Unicredit, Rome, Italy

    Francesco Gullo

  48. ENEA Headquarters, Portici, Italy

    Giovanni Ponti

  49. Unicredit, Rome, Italy

    Lorenzo Severini

  50. University of Porto, Porto, Portugal

    Rita Ribeiro

  51. University of Porto, Porto, Portugal

    João Gama

  52. UPC BarcelonaTech, Barcelona, Spain

    Ricard Gavaldà

  53. Northwestern University, Chicago, IL, USA

    Lee Cooper

  54. PD Personalised Healthcare, Basel, Switzerland

    Naghmeh Ghazaleh

  55. University of Lausanne, Lausanne, Switzerland

    Jonas Richiardi

  56. ETH Zurich, Basel, Switzerland

    Damian Roqueiro

  57. F. Hoffmann–La Roche Ltd, Basel, Switzerland

    Diego Saldana Miranda

  58. Novartis Pharma AG, Basel, Switzerland

    Konstantinos Sechidis

  59. University of Lisbon, Lisbon, Portugal

    Guilherme Graça

Rights and permissions

Reprints and permissions

Copyright information

© 2021 Springer Nature Switzerland AG

About this paper

Check for updates. Verify currency and authenticity via CrossMark

Cite this paper

AL-Essa, M., Appice, A. (2021). Dealing with Imbalanced Data in Multi-class Network Intrusion Detection Systems Using XGBoost. In: Kamp, M., et al. Machine Learning and Principles and Practice of Knowledge Discovery in Databases. ECML PKDD 2021. Communications in Computer and Information Science, vol 1525. Springer, Cham. https://doi.org/10.1007/978-3-030-93733-1_1

Download citation

  • DOI: https://doi.org/10.1007/978-3-030-93733-1_1

  • Published:

  • Publisher Name: Springer, Cham

  • Print ISBN: 978-3-030-93732-4

  • Online ISBN: 978-3-030-93733-1

  • eBook Packages: Computer ScienceComputer Science (R0)

Publish with us

Policies and ethics

Search

Navigation