Improving Intrusion Detection Through Training Data Augmentation

Abstract

Imbalanced classes in datasets are common problems often found in security data. Therefore, several strategies like class resampling and cost-sensitive training have been proposed to address it. In this paper, we propose a data augmentation strategy to oversample the minority classes in the dataset. Using our Sort-Augment-Combine (SAC) technique, we split the dataset into subsets of the class labels and then generate synthetic data from each of the subsets. The synthetic data were then used to oversample the minority classes. Upon the completion of the oversampling, the independent classes were combined to form an augmented training data for model fitting. Using performance metrics such as accuracy, recall (sensitivity) and true positives (specificity), the models trained using the augmented datasets show an improvement in performance metrics over the original dataset. Similarly, in a binary class dataset, SAC performed optimally and the combination of SAC and ROSE model shows an improvement in overall accuracy, sensitivity and specificity when compared with the performance of the Random Forest model on the original dataset, ROSE and SMOTE augmented datasets.

Ensemble Common Features Technique for Lightweight Intrusion Detection in Industrial Control System

“…This is because the number of observations of the other classes are lower than the number of observations in the majority class. As a result, we augmented the dataset by oversampling the minority classes to the number of the majority class by using the approach by [18]. The number of observations in the benign class was used as the baseline for the oversampling of the minority classes.…”

“…As shown in Table III, the distribution is heavily skewed towards the Normal class, resulting in a highly imbalanced dataset. In light of this, we augmented the minority classes using the approach proposed by [18]. Also, the number of observations in the benign class formed the threshold for oversampling the minority classes.…”

Atualização de Modelo baseado em Aumento de Dados e Transferência de Aprendizagem para Detecção de Intrusão em Redes

“…Nos últimos anos, as técnicas de aumento de dados têm sido cada vez mais utilizadas para fins de construc ¸ão de modelos de AM. Por exemplo, U. Otokwala et al [Otokwala et al 2021] propuseram uma abordagem de aumento de dados para equilibrar a ocorrência de tráfego de rede durante a construc ¸ão do modelo, aumentando a taxa de detecc ¸ão, mas desconsiderando a sua aplicac ¸ão para atualizac ¸ões do modelo. Um aumento do conjunto de dados baseado em GAN foi proposto por G. Andresini et al [Andresini et al 2021] para lidar com o desequilíbrio de classes.…”