Intrusion Detection System Using K-means SMOTE Algorithm with Multi-dense Layer Bidirectional Long Short-term Memory

Abstract

Internet of Things (IoT) has accomplished substantial increase in network traffic and high dimensionality. So, Network Intrusion Detection Systems (NIDS) are crucial in increasing IoT environment security. Even though, there are several difficulties for developing an accurate and efficient NIDS, particularly when working with high-dimensional statistics which contains unpredictable unforeseen attacks, along with imbalanced class distribution. This research proposed a novel class balance and classification method name called K-means SMOTE algorithm with Multi- Dense Layer Bidirectional Long Short-Term Memory (K-means SMOTE-MBiLSTM) for effective network intrusion detection. K-Means SMOTE is one of the oversampling methods used for class-imbalanced data and supports classification by producing minority class samples in the input space. Furthermore, it eliminates the noise generation and efficiently overcomes the class imbalance data. The datasets used to gather data are the CIC-IDS-2017, CIC-DDoD2019, IoTID20 and NSL-KDD datasets. Next, one-hot encoding and Z-score normalization techniques are employed in pre-processing for ensuring categorical data compatibility, and standardizing the numerical features. The data balance process is performed by using K-means SMOTE algorithm to balance data. Then, to categorize network intrusion as malicious or normal, multi-dense layer BiLSTM is proposed in this research which is more suitable for data with various structure and dependencies. Additionally, it has the capability to acquire complex patterns and learn the relationship among various input parts. Therefore, the proposed K-means SMOTE-MBiLSTM achieves the highest values of accuracy 99.85%, 99.80%, 99.99% and 99.83% on the CIC-IDS-2017, CIC-DDoD2019, IoTID20 and NSL-KDD datasets when compared with existing methods like Robust Transformer-based Intrusion Detection System (RTIDS) and convolutional neural network with attention BiLSTM (CNN-AttBiLSTM).