XIDINTV: XGBoost-based intrusion detection of imbalance network traffic via variational auto-encoder

Abstract

In networks characterized by imbalanced traffic, detecting malicious cyber-attacks poses a significant challenge due to their ability to blend seamlessly with regular data volumes. This creates a formidable hurdle for Network Intrusion Detection Systems (NIDS) striving for accurate and timely identification. The imbalance in normal and attack data, coupled with the diversity among attack categories, complicates intrusion detection. This research proposes a novel approach to address this issue by combining Extreme Gradient Boosting with variational autoencoder (XIDINTV). The methodology focuses on rectifying class imbalance by generating diverse rare-class attack data while maintaining similarities with the original samples. This enhances the classifier’s ability to discern differences during training, improving classification performance. Evaluations on NSL-KDD and CSE-CICIDS2018 datasets demonstrate the effectiveness of XIDINTV, particularly when compared to SMOTE sampling technique and traditional classification models, with Xtreme Gradient Boosting excelling in detecting rare instances of attack traffic.