Tackling Class Imbalance in Cyber Security Datasets

Wheelus, Charles; Bou‐Harb, Elias; Zhu, Xingquan

doi:10.1109/iri.2018.00041

Cited by 27 publications

(17 citation statements)

References 10 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…21 Wheelus et al showed that the pre-processing of datasets to address class imbalance does indeed provide some benefit using UNSW-NB15 dataset. 23 Pattawaro and Polprasert obtained 86.36% detection rate with the proposed hybrid model that uses combination of feature selection, K-means and XGBoost methods using NSL-KDD dataset. 24 Mirza developed an ensemble method that combines logistic regression, neural networks, and decision trees and obtained 96.14% detection rate using KDDCup99 dataset.…”

Section: Related Workmentioning

confidence: 99%

“…Various methods have been proposed in the literature for network anomaly detection including standard machine learning classifiers 4–29 and deep learning techniques 30–47 . Muda et al performed clustering before classification and compared the single classifiers with hybrid classifiers.…”

Section: Related Workmentioning

confidence: 99%

“…Guha et al developed an ensemble method that combines artificial neural networks with genetic algorithm and obtained 91.98% accuracy rate on two large datasets 21 . Wheelus et al showed that the pre‐processing of datasets to address class imbalance does indeed provide some benefit using UNSW‐NB15 dataset 23 . Pattawaro and Polprasert obtained 86.36% detection rate with the proposed hybrid model that uses combination of feature selection, K‐means and XGBoost methods using NSL‐KDD dataset 24 .…”

Section: Related Workmentioning

confidence: 99%

See 2 more Smart Citations

A deep learning approach with Bayesian optimization and ensemble classifiers for detecting denial of service attacks

Görmez

Aydın

Karademir³

et al. 2020

Int J Communication

View full text Add to dashboard Cite

Summary Detecting malicious behavior is important for preventing security threats in a computer network. Denial of Service (DoS) is among the popular cyber attacks targeted at web sites of high‐profile organizations and can potentially have high economic and time costs. In this paper, several machine learning methods including ensemble models and autoencoder‐based deep learning classifiers are compared and tuned using Bayesian optimization. The autoencoder framework enables to extract new features by mapping the original input to a new space. The methods are trained and tested both for binary and multi‐class classification on Digiturk and Labris datasets, which were introduced recently for detecting various types of DDoS attacks. The best performing methods are found to be ensembles though deep learning classifiers achieved comparable level of accuracy.

show abstract

Section: Related Workmentioning

confidence: 99%

Section: Related Workmentioning

confidence: 99%

Section: Related Workmentioning

confidence: 99%

See 1 more Smart Citation

A deep learning approach with Bayesian optimization and ensemble classifiers for detecting denial of service attacks

Görmez

Aydın

Karademir³

et al. 2020

Int J Communication

View full text Add to dashboard Cite

show abstract

“…The class imbalance problem in datasets has been investigated in the literature by some researchers. Wheelus et al [20] used bagging, undersampling and synthetic minority oversampling on the UNSW-NB15 dataset [15] to tackle the problem. Their experiments on this network-flow-only dataset have shown significant performance improvement in terms of classification accuracy.…”

Section: Class Imbalancementioning

confidence: 99%

Analyzing the Usefulness of the DARPA OpTC Dataset in Cyber Threat Detection Research

Anjum

Iqbal

Hamelin³

2021

Proceedings of the 26th ACM Symposium on Access Control Models and Technologies

View full text Add to dashboard Cite

Maintaining security and privacy in real-world enterprise networks is becoming more and more challenging. Cyber actors are increasingly employing previously unreported and state-of-the-art techniques to break into corporate networks. To develop novel and effective methods to thwart these sophisticated cyber attacks, we need datasets that reflect real-world enterprise scenarios to a high degree of accuracy. However, precious few such datasets are publicly available. Researchers still predominantly use the decade-old KDD datasets, however, studies showed that these datasets do not adequately reflect modern attacks like Advanced Persistent Threats (APT). In this work, we analyze the usefulness of the recently introduced DARPA Operationally Transparent Cyber (OpTC) dataset in this regard. We describe the content of the dataset in detail and present a qualitative analysis. We show that the OpTC dataset is an excellent candidate for advanced cyber threat detection research while also highlighting its limitations. Additionally, we propose several research directions where this dataset can be useful. CCS CONCEPTS• Security and privacy → Intrusion detection systems.

show abstract

“…Real-world data from the domain of medical [22], text [36], software defect prediction [2], and fraud detection [31] often have significant imbalance between target classes. In a binary classification dataset with class-imbalance, the class with more instances and the class with fewer instances are known as the majority and the minority class respectively.…”

Section: Introductionmentioning

confidence: 99%

Random Walk-steered Majority Undersampling

Sadhukhan¹,

Pakrashi²,

Namee³

2021

Preprint

View full text Add to dashboard Cite

In this work, we propose Random Walk-steered Majority Undersampling (RWMaU), which undersamples the majority points of a class imbalanced dataset, in order to balance the classes. Rather than marking the majority points which belong to the neighborhood of a few minority points, we are interested to perceive the closeness of the majority points to the minority class. Random walk, a powerful tool for perceiving the proximities of connected points in a graph, is used to identify the majority points which lie close to the minority class of a class-imbalanced dataset. The visit frequencies and the order of visits of the majority points in the walks enable us to perceive an overall closeness of the majority points to the minority class. The ones lying close to the minority class are subsequently undersampled. Empirical evaluation on 21 datasets and 3 classifiers demonstrate substantial improvement in performance of RWMaU over the competing methods.

show abstract

Tackling Class Imbalance in Cyber Security Datasets

Cited by 27 publications

References 10 publications

A deep learning approach with Bayesian optimization and ensemble classifiers for detecting denial of service attacks

A deep learning approach with Bayesian optimization and ensemble classifiers for detecting denial of service attacks

Analyzing the Usefulness of the DARPA OpTC Dataset in Cyber Threat Detection Research

Random Walk-steered Majority Undersampling

Contact Info

Product

Resources

About