CBF-IDS: Addressing Class Imbalance Using CNN-BiLSTM with Focal Loss in Network Intrusion Detection System

Abstract

The importance of network security has become increasingly prominent due to the rapid development of network technology. Network intrusion detection systems (NIDSs) play a crucial role in safeguarding networks from malicious attacks and intrusions. However, the issue of class imbalance in the dataset presents a significant challenge to NIDSs. In order to address this concern, this paper proposes a new NIDS called CBF-IDS, which combines convolutional neural networks (CNNs) and bidirectional long short-term memory networks (BiLSTMs) while employing the focal loss function. By utilizing CBF-IDS, spatial and temporal features can be extracted from network traffic. Moreover, during model training, CBF-IDS applies the focal loss function to give more weight to minority class samples, thereby mitigating the impact of class imbalance on model performance. In order to evaluate the effectiveness of CBF-IDS, experiments were conducted on three benchmark datasets: NSL-KDD, UNSW-NB15, and CIC-IDS2017. The experimental results demonstrate that CBF-IDS outperforms other classification models, achieving superior detection performance.

Network Intrusion Detection Method Based on CNN-BiLSTM-Attention Model

“…Although the above methods improve the detection rate of intrusion detection models for minority class data, in real life, there is a certain degree of skewness in the class distribution of many intrusion data, and relying solely on datalevel methods may reduce the accuracy of certain types of intrusion data. In the field of network intrusion detection, cost-sensitive learning methods have the advantages of high efficiency and low time cost when dealing with imbalanced data, while not requiring additional data processing [11], [12], [13]. Cost-sensitive learning methods assign a larger cost factor to minority class data, thereby improving the detection rate of classifiers for minority class data.…”